{ "Event": { "published": true, "date": "2022-03-09", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2022-03-09", "timestamp": 1646870581, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "4388b23a-c325-4c16-87fa-3f3bd5c7cf2e", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5447515e-9fc4-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1646842611, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646842611, "uuid": "97c35a26-d8d0-4610-b2f8-7c960b672bf9", "comment": "Malware payload (Mirai)", "value": "cb7f9527830ac489054f6c764582c03e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646842611, "uuid": "6f5d39dd-d584-4727-afcb-7e6c95d459ab", "comment": "Malware payload (Mirai)", "value": "0050bc7eb6df49081e0312206dccd12da0e6433001c326f1c38c8cd3d6c77d7b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646842611, "uuid": "ddca4932-a842-4f4e-ab54-4b19a78e5862", "comment": "Malware payload (Mirai)", "value": "e2dc615ce3cdf5fd95d0c73d9a2cdf5c17271f95", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646842611, "uuid": "7591d604-2045-4f35-9304-e06cfa586af9", "comment": "Malware payload (Mirai)", "value": "5a767d218602bb3688b911900c4149e0dd6ba9e8edfddb704c9e99018871644eb381f23dc6d70e5daa3660c929ac158b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646842611, "uuid": "280e489b-ff2f-4b51-9eb5-1d69f34e8dc2", "value": "T182C2E03E11549BF3C83A94F542920A221C794FF2E527594F7E95EA63CFA26A120CF7C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646842611, "uuid": "56d6cbb6-1a85-4b04-97f6-1e4d37ba90c6", "value": "768:SgBmeJ0k9HNVhjRNtvUy6HZJgGlzDpuWm:SgBik9HNVhjRNRUysVEWm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646842611, "uuid": "00609377-189e-4135-9ac2-3716ac30bff7", "value": 26028, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646842611, "uuid": "6f54c2ed-755f-4948-af30-f4de7bf53df3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646842611, "uuid": "329f7149-dcab-430e-b2eb-aecdcc0fb07c", "value": "cb7f9527830ac489054f6c764582c03e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ce0a277-9fe7-11ec-9275-42010a9c0029", "comment": "Malware payload (CoinMiner.XMRig)", "timestamp": 1646857578, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646857578, "uuid": "c61238b6-c9f4-4d38-87ea-909043597e8e", "comment": "Malware payload (CoinMiner.XMRig)", "value": "126e46f01c28947d9a1953d9bf11a604", "object_relation": "md5", "Tag": [ { "name": "CoinMiner.XMRig", "colour": "#C10C3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646857578, "uuid": "c28d56cc-4340-41e9-9000-a0f5137e7139", "comment": "Malware payload (CoinMiner.XMRig)", "value": "0094d3f44091633d863c94bc2fe63279aa50b40540f1fee23b523cf0b8ed1f9f", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner.XMRig", "colour": "#C10C3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646857578, "uuid": "6f87ef71-aee8-4dfc-94df-82a216614752", "comment": "Malware payload (CoinMiner.XMRig)", "value": "33e1f126abf51764be79518d92659b30ff1ac7c7", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner.XMRig", "colour": "#C10C3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646857578, "uuid": "c483ba94-1fcd-4dde-a378-f1166e09580b", "comment": "Malware payload (CoinMiner.XMRig)", "value": "432e9c00821bced31d071e4b0bf35b79787c688d6bfbc777cb1ce5650432efeef975595f325d95322d09f373d2d16544", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner.XMRig", "colour": "#C10C3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646857578, "uuid": "7d40a7c2-1844-4522-abdb-536e1baef08f", "value": "T195863362052D1469AFD4336CB14172FA3EF416A1ED538BFA11EBD84B066721FB2BEC05", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646857578, "uuid": "4dd27bc0-1300-44f3-8a85-717f5f3e49ea", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646857578, "uuid": "87411d31-15c7-496e-ac7d-a3d38e53ed67", "value": "196608:PHxAoAMQDDCV5DqhXb0xEwoWJ5dENJv8MbF/bmIn4ac:Ph/QDGV5iXIATLvxZC049", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646857578, "uuid": "3a439208-4c1c-4b1a-96d6-dc1dfc56666c", "value": 8555520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646857578, "uuid": "81bb0c5c-3542-46f4-a1d9-0dbf67db25dd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646857578, "uuid": "75087967-5574-476e-a265-3a73971ebbcf", "value": "126e46f01c28947d9a1953d9bf11a604", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6bf96193-9fa5-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1646829337, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646829337, "uuid": "e1df96df-1c2c-48f9-ae25-3228827b01c3", "comment": "Malware payload (RedLineStealer)", "value": "b2863402cb9edd6456dd0c7fdf396735", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646829337, "uuid": "9fff41ca-1ea1-4ed5-9e77-b6fb22470220", "comment": "Malware payload (RedLineStealer)", "value": "018f2af002d120d8f1008f4050a4f25762812a8e24f9cf8c506eff6009546dc8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646829337, "uuid": "4f9dad24-9c85-4f28-a277-26fac7de59d0", "comment": "Malware payload (RedLineStealer)", "value": "3c23bf510ec04987d8ac723d5ba441b4f824cae5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646829337, "uuid": "9ce1b85d-6bb3-430c-b9fd-6f77a2b103e4", "comment": "Malware payload (RedLineStealer)", "value": "fb411ad74b286d0e14beac831a54cd654e218961c0fa68fba1caa41605aad821322568315878ff698ee217cef07b835b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646829337, "uuid": "7b1b91af-0104-41e4-a356-b2bbdf98181c", "value": "T1A2E53302BAC284B3E127453215152766B47C3D253E388FAB73C85E6DED320619B79FA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646829337, "uuid": "ceb09679-9a6b-497d-b9c4-33651d6ae225", "value": "00be6e6c4f9e287672c8301b72bdabf3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646829337, "uuid": "d70f0836-0af2-4318-b1d2-a8011f5d80e3", "value": "49152:V5Ov7ddEluQa+Bb/9JS929DC1O0dUEkRY0yrWmNKnImzKu6FYkixHtnSfN/hFN:V5oOhhvDQOnRY0yxyzfUixNSlDN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646829337, "uuid": "5f587e76-d1be-4d16-a6c7-444b92c64dcc", "value": 3277670, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646829337, "uuid": "1ae8cba7-a8d5-4af9-b6c7-f08846d38032", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646829337, "uuid": "f6931825-5adb-429f-9a9d-3e6e07c178af", "value": "b2863402cb9edd6456dd0c7fdf396735.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66c0527e-9fc4-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1646842642, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646842642, "uuid": "c3735f7b-9801-430e-80d4-9c83e218b6d2", "comment": "Malware payload (Mirai)", "value": "781e3650babe04574721cf2f4a948f4a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646842642, "uuid": "2480ed63-64b6-42e1-aa13-2d30bc74a29b", "comment": "Malware payload (Mirai)", "value": "01b2572f04143ff848ce2d2f05b5f25d7a07638676b5c6a7b76af7c9ca49aeb7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646842642, "uuid": "e63d561a-2e41-449d-9efa-316e1cbece8b", "comment": "Malware payload (Mirai)", "value": "95831df45742ace6a0f943fd6c07bc1bd5a71816", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646842642, "uuid": "65ee864f-0e96-463d-b5c8-3ebc80f00f18", "comment": "Malware payload (Mirai)", "value": "878c25cc3315514b05aec1d8bb81544f77779c9a002acebe9c2f2150cbb7eaa03c1d4d73bf8c7f9aa457cb8c220cd075", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646842642, "uuid": "1850952e-80e1-4df5-9537-fe9f1e3c8bba", "value": "T136E2D14ED4E3EAC7D6DC497D400F1B2B741271D4719FA26817288484A77EB8A75CC4F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646842642, "uuid": "815144e5-c155-499d-bcd9-0261b9d61616", "value": "768:ouGLlF/6QO3KA4YhyQiH3HN4+Ww9qQuNUWTNKQ:ors4YhyQidrl9axNr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646842642, "uuid": "c877c3fc-f1e3-4eba-9d0e-73242cba2eed", "value": 31236, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646842642, "uuid": "c942ea80-ec7c-4692-8c84-ba1bef10ab63", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646842642, "uuid": "931453cc-1a11-489e-b0db-a9ff97939be0", "value": "781e3650babe04574721cf2f4a948f4a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8f3f816-9fb8-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1646837626, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646837626, "uuid": "eb262829-6ec5-4c68-aef0-78d928260700", "comment": "Malware payload (Formbook)", "value": "876c54c2f41506ed67be2508e0d2083d", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646837626, "uuid": "8bc65119-4846-4b41-8707-c9905ba5e536", "comment": "Malware payload (Formbook)", "value": "025044f7a2faa59b85b27b23caa7c38642ac42a620d6b50e3894a23436dcca75", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646837626, "uuid": "2a2cb81b-08fd-47d6-81a5-47392f020952", "comment": "Malware payload (Formbook)", "value": "e8584b0bec2470d0292ebf7a7c4197711b5b3045", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646837626, "uuid": "639673f5-b30d-4a18-ad8e-e7f76aa9f548", "comment": "Malware payload (Formbook)", "value": "5c89b2bce81064149bf8c4a0e372a7b4550934f33b382c6e013d85a5e2d333a13446bf91e805f3e52f9c19fd56b7ee22", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646837626, "uuid": "66d9bbd6-0377-490c-920b-d48c7f061a74", "value": "T1651412A83A50D619E0E98A313EE1B947B229FE93C2415F2E0CD7352B11F9511DD9734F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646837626, "uuid": "1a8c01b9-217b-405a-b4c3-0618aabb7f94", "value": "3072:RzT3h1nVTwmj2N6cGUU+NNTPK+2VjLx8dYSjUtXBLwLJ08uU:1V3T2N1GULb41Lx6YOUzLwLJLuU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646837626, "uuid": "c2b742b9-d7b3-4f33-9044-ddf0bf31937b", "value": 191240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646837626, "uuid": "37adf4d6-f5cb-4cb3-a990-cba40b01f85e", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646837626, "uuid": "fd97be31-622e-4265-9bd9-b735cc128aef", "value": "DHL_AWB_202203078849.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77212b11-9f9d-11ec-9275-42010a9c0029", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1646825919, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646825919, "uuid": "c5d61890-a5c2-4c01-b1df-3cc55f06dd76", "comment": "Malware payload (AveMariaRAT)", "value": "d7491fd9a607003cdfc87ab38e368937", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646825919, "uuid": "a8f9ebb2-c07c-4bd0-ba85-0f5e4bf73cd8", "comment": "Malware payload (AveMariaRAT)", "value": "032b470bea30ebbb1171b302b3fbcea932ef7602c475f14abd05ac789d9f0188", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646825919, "uuid": "bcf29bb0-6578-4cf5-a46b-d52bc91a5070", "comment": "Malware payload (AveMariaRAT)", "value": "647983aca1c8fad341b6a91661c3f1cddbc2fc9a", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646825919, "uuid": "43e46363-1f69-40a2-a728-02fda3aa5b11", "comment": "Malware payload (AveMariaRAT)", "value": "7fd9b389b8df54ac66b2467aaf4d79fa3bdfe5bc2c3ecad1591088361d6515b9ab863c4d7fe901ab115c14eb4d3a7cf1", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646825919, "uuid": "d1834bea-4f6e-418e-a2b0-876901783020", "value": "T10645D964A3A51105E9C7E77F73A04B90C8AE3C419C6EA78F4D464AC6C62E3F479086F7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646825919, "uuid": "3ac7167f-7645-4211-9e8f-d620143b13ab", "value": "e565b640556a2f3c5b5d74f39577630a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646825919, "uuid": "5278f6b5-8204-4c90-ab74-4f78cac80b65", "value": "6144:Aa00RiTwSltgxCKYPMXq9NmiQBYGhpX8x4MWy1FYCz8hJ2n3C+8Jk7UBj7AlL5ai:QD4pa7+o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646825919, "uuid": "49541e23-2aa3-4fec-a7cf-9303e8f8cc42", "value": 1227264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646825919, "uuid": "cd0fc082-167c-4492-b791-06b2e8ba16f1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646825919, "uuid": "b348f7ec-56ca-480a-be41-ce6f686b2d8d", "value": "193053008-060344.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5905cba6-9fbf-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646840472, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646840472, "uuid": "c147d202-51e2-4311-89c2-34c047a526bf", "comment": "Malware payload (Heodo)", "value": "5ea1e4353f9ddbda1e622a1daac518f7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646840472, "uuid": "baaa552c-d3ea-4146-b3ec-f5dcf045dce8", "comment": "Malware payload (Heodo)", "value": "03600a4f7296b322c40348594b789a94fd3726489d06ca31365f3337cd53a197", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646840472, "uuid": "7877fa06-315c-42a3-a9c2-39c2cc235ef0", "comment": "Malware payload (Heodo)", "value": "70dc2de39fc023a1684ccb0ec8361989970f6f61", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646840472, "uuid": "8b7249a7-5409-49e6-8be7-820aaa004f93", "comment": "Malware payload (Heodo)", "value": "02e7100db7a93f6d84cb3d4094f8a2b46489408b5deb633ce68eb3163ef63e6fc529d3d90efeb7a85cdf46c0b90f2332", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646840472, "uuid": "9ecdd84f-caae-44cf-9cf3-113d40e850a4", "value": "T176257C107E8A817EC71B85B30836676D6FFEAB204B6CA1CB478175ED2D316C29B36705", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646840472, "uuid": "f12315b7-69eb-41fc-9bc1-df3d886e41a9", "value": "087c9809507dfca4c3283e6c7539e91c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646840472, "uuid": "30518666-3092-4ea3-8f19-a425a66313dd", "value": "12288:cR5SOyRHiA6m0OcEl+zt6JtcS1j2xKkr:cR5SOrKl+zEtcK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646840472, "uuid": "9ad26631-c4c6-4f8f-b08a-c1c19d0faa35", "value": 1040384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646840472, "uuid": "30306e7d-d0f0-4abe-a286-203bd0b9dc98", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646840472, "uuid": "2a7627c4-dad3-4848-bb77-858d99fcbf62", "value": "5ea1e4353f9ddbda1e622a1daac518f7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b4329e3-9fbf-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1646840449, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646840449, "uuid": "0cb99930-6855-47b7-a677-8afe7afbc964", "comment": "Malware payload (Mirai)", "value": "d8ec39dbdf61711069818ea8ce025182", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646840449, "uuid": "8b036749-5fc8-4fe4-b03a-2ac7d26f1fcb", "comment": "Malware payload (Mirai)", "value": "0486b20438b2d47c5cad9c66e7af604cab5959e47dcb61f2b8dd83f9c07a03df", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646840449, "uuid": "2bbb7a54-49fc-4ce8-a327-04ca108f305d", "comment": "Malware payload (Mirai)", "value": "cde8d309a31e953159320b9ba2fb0afac799a68e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646840449, "uuid": "48f7c332-338e-465c-a62a-52207c880426", "comment": "Malware payload (Mirai)", "value": "c40d3951469e366601d0db928421d19ce240e7dceac738a01752c1b504316b39fc39b5136572c740c8cfcbc0aad02413", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646840449, "uuid": "1d28437a-fc68-4e11-9bdc-51742af518e1", "value": "T19A235CC5A447D9FCEC190A752177EF319AF6E93F1098D983C398AD73E942602E5072AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646840449, "uuid": "fc7cb026-0b40-48a1-ab76-616f2a84c196", "value": "768:Ii+liNWE5NttVEi4Ws5BkbVTco8UH2Wfd/0A6SDZkAKo:IiK25NttVEi4WszsVTcdWV/0A6OZk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646840449, "uuid": "a33031bc-12c5-4a9b-931c-51f5082e6af8", "value": 49756, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646840449, "uuid": "8a067e0f-1a2e-4689-8c28-85aed8e62a43", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646840449, "uuid": "385b4f3c-10ee-43fd-9d00-0ec3a1b4aabd", "value": "d8ec39dbdf61711069818ea8ce025182", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "177b0846-9fc4-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1646842509, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646842509, "uuid": "3ddc77b6-e80a-4666-9e93-f25ac9adca78", "comment": "Malware payload (Mirai)", "value": "b3f3069da4cb2c90609c948d4bbbf02b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646842509, "uuid": "20351342-c31e-4d96-a171-51b19b6c6901", "comment": "Malware payload (Mirai)", "value": "04d3ab6049bd27e7c9b53c996018eae2587afede98699f4019744655dfac7546", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646842509, "uuid": "8007861c-c35b-47d3-8933-55a0bbeb300c", "comment": "Malware payload (Mirai)", "value": "058c3c9fa142bed65700e511226acdfbcd879319", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646842509, "uuid": "fdd0e6dc-d374-491f-855d-318da65c7f91", "comment": "Malware payload (Mirai)", "value": "2d941914841e203fe517e1ca455b4f6edd6be56da0debac6fefae665f7c1db7fbff9d828ff536c424f8fbce53dacde9d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646842509, "uuid": "05618fbe-2a51-4bef-8b88-3d53e9775e18", "value": "T1F3A2D177C6852653CB311D73A81EA3919B87D894E273616038098B457BE3C2276BF3BD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646842509, "uuid": "e8fc1651-7490-4b74-ad3a-87f7eec51c7e", "value": "384:pSwZfBW+Ggi3r5ZBeA4D8fExHXCQsM22JXkIRufWEw5/vX/l4Lm8tmdGU57DJ/z:cwZpgr5zerD8fGXCjM9+QgWx5/ft4LTK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646842509, "uuid": "a079e0bb-79bb-43fb-ba08-5520d31421a3", "value": 21948, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646842509, "uuid": "2ffa24f6-133e-425d-974c-692df8c03e0d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646842509, "uuid": "6a78acda-21bc-481a-b4ef-ed409076ed3f", "value": "b3f3069da4cb2c90609c948d4bbbf02b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "827eaadb-9f7d-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1646812195, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646812195, "uuid": "0c006691-61be-4ee4-930e-926ba7b3225c", "comment": "Malware payload (AgentTesla)", "value": "2f039486a5f6f74c40c91d8df972ee39", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646812195, "uuid": "fcf49757-d799-4841-8c75-8a0994cb5d86", "comment": "Malware payload (AgentTesla)", "value": "05ce2b7d38f77edf1ffa7c0b050453b34a1abad8eb58bfafd99aba897240ed4b", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646812195, "uuid": "797016a0-2272-41f0-8e9b-7ba87420a088", "comment": "Malware payload (AgentTesla)", "value": "908b2853fd4606734c0eddc374eccab3120b11e6", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646812195, "uuid": "153dd8b8-368e-480b-8cbd-64a78bca1e4d", "comment": "Malware payload (AgentTesla)", "value": "97e5cf64bf90391454a9935409bfbd8c6ce7d7d0577c20df39f6d617ae8f93f5ece08e648f8821d37128e631ad63372c", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646812195, "uuid": "0a5d65f2-c81c-4ee3-b3f3-7586b182a81e", "value": "T13EE423FE6F7E42DCBA9A7126185DB952161608A1A17139D0F149FECA3FDC2C0063CDE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646812195, "uuid": "94f01cc1-166d-4571-9ccb-fa65860af77f", "value": "12288:07Zc2T1ng2V0fKqSTSCewPdeTMZXlH/q16cVolMMkN9S1weXSf99:1w1gs3Dew1LXw16cVolMMIS1JXSf99", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646812195, "uuid": "bc95e3e3-c666-4c00-8f90-65cabe0ad6df", "value": 713449, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646812195, "uuid": "7252b60f-f294-43e5-977a-c32973fe5e72", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646812195, "uuid": "340daa6d-5ecb-492b-9cd6-00e20af1d3c7", "value": "DHL Shippping documents.pdf.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8bb900cb-9f83-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1646814787, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646814787, "uuid": "a8f739f4-11c9-4088-93e0-8daf52e9841e", "comment": "Malware payload (Formbook)", "value": "7f909444541e5a9c6beaeec07d65f1a0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646814787, "uuid": "33b023af-2e9a-484a-9c0b-85586b28ae11", "comment": "Malware payload (Formbook)", "value": "05e170ef6fe2dfc1ff74568d8467cf94d0e99c5cfab7c464080e4e505b72bcfb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646814787, "uuid": "86efdbb3-2601-461d-8a1b-f87adf4c0f3b", "comment": "Malware payload (Formbook)", "value": "843a9dc1f32ed15401d4202d1abd5042cd4357df", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646814787, "uuid": "a62eeb26-90e6-4b0d-a319-058084bcc42c", "comment": "Malware payload (Formbook)", "value": "51d87f4709246a52d3706b048421739a62fee25aeb74c22122450c9ab68f2d16278c4f56c8562343098b6275d231208e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646814787, "uuid": "1b45ee7f-9280-40e0-850c-66e8b7f5408a", "value": "T1C2F4C69C312431DFC96BD6759AA81D68FFA03C7B831B511B902731AD9A3C987DF244B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646814787, "uuid": "3b3d746a-de00-471c-98bf-4217c576193f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646814787, "uuid": "9f240aa1-51b8-4fe0-9e39-914263931e79", "value": "12288:NrqcP7zk+ohiLrWWxJSsE0ExHs2jcLK7YwPIKrkaOjvT8PWaURhbFNdj7HQCr3eQ:NlTWgrWWxJSP0KM2oLK4U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646814787, "uuid": "389f7fd8-f5df-491b-a857-e18448bba018", "value": 747520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646814787, "uuid": "c6e2aa19-7f2d-47f9-9728-f556be1ba53b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646814787, "uuid": "1c3c53c1-73f2-48d6-8dc5-20d508673fcb", "value": "SOA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "101bed9c-9fdc-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646852805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646852805, "uuid": "e80efc9c-2111-4773-bf57-97bb04e1a649", "comment": "Malware payload (Heodo)", "value": "9ee3dcc5ff73a6535320a26e8e209aa9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646852805, "uuid": "45cf8a57-b5c0-4201-bb12-1d6db67f3795", "comment": "Malware payload (Heodo)", "value": "05f583b265166ede5ff15f09b7e1c0f3cd2dc005bee8a94e5f5241eafe5678ac", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646852805, "uuid": "6c3c8fdf-e1e6-45f4-a936-1e46c24fd4e2", "comment": "Malware payload (Heodo)", "value": "2d552252f35f19494bd7c6da722ca586655f3dbc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646852805, "uuid": "b47503c4-bc76-4d4b-9bd2-d3e679c8084a", "comment": "Malware payload (Heodo)", "value": "87622effad289b474dc467a1fc23c41b3a46462c21df50e99bcb114593a0995fa2ae1d7da5d61f43898d270bc41646f1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646852805, "uuid": "9666daf9-bc87-4c14-add4-3f4aeefcd20e", "value": "T107257C107E8A817EC71B85B30836676D6FFEAB204B6CA1CB478175ED2D316C29B36705", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646852805, "uuid": "c702114f-620e-47ce-b0f4-f2d1de9aa1b2", "value": "087c9809507dfca4c3283e6c7539e91c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646852805, "uuid": "a34c3836-2f28-4397-8df0-a0bd22109425", "value": "12288:cR5SOyRHiA6m0OcElmzt6JtcS1j2xKkr:cR5SOrKlmzEtcK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646852805, "uuid": "28b3be7e-6322-458f-9df7-260eb2506f29", "value": 1040384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646852805, "uuid": "c88ee440-5b45-4dea-9cbe-169d55b110e2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646852805, "uuid": "dc011b0c-c920-48d3-97a7-281311dd86d9", "value": "9ee3dcc5ff73a6535320a26e8e209aa9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36f1cdf7-9fb8-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646837408, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646837408, "uuid": "f19e5ddd-ea10-4a75-afd9-6a1869623929", "comment": "Malware payload", "value": "8fd37eb3cc3796e3236e6df263aa834a", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646837408, "uuid": "2f9160eb-8a07-4d55-a6fe-9e9bf9d7a145", "comment": "Malware payload", "value": "06d40533f2403961533f1c66ea01649178e85842cea20315dc03fecf4fd2e5e2", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646837408, "uuid": "37d62ab4-7773-453c-99df-d60e618a0e09", "comment": "Malware payload", "value": "8ba75bea43587bef671fa3dba33199815d52a617", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646837408, "uuid": "82d87720-c672-41c7-80b0-c101fe03a2da", "comment": "Malware payload", "value": "9eac927de88eb8dd5d6c3b3b300879a160cc62e4e8c6a088bf29ed2a415c8317285cae561e3dfccda24afa9d9cfe225d", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646837408, "uuid": "2772ce1f-b6fd-44f7-84f8-00255b1e922e", "value": "T10A1402A5F20AA267C833687C0A33D0B046CA9D468D1AF3751C517A77AEF760CDCD4AB5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646837408, "uuid": "e6ef2c5d-a66e-45e1-803e-85cea18be74f", "value": "3072:djqjsG7mMIc8IukvR4fwWxh17reIAVUDq/cDJMVLunMcRttb2CEbKr0h++lilLXO:J0RJJ8IukJ4fwWX17nUqipmvON8+lilq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646837408, "uuid": "4bd46e63-962a-4666-9960-f079ec4a6cbd", "value": 191128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646837408, "uuid": "a680fc03-7a34-4b58-a6a9-0e007c29a86e", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646837408, "uuid": "d0df2921-2f75-4e08-8dd7-5353d7cf1a5d", "value": "DHL Receipt_AWB2045829822.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd51dc2c-9fee-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646860853, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646860853, "uuid": "5d687a2e-de97-4152-a208-2dc2ede87f13", "comment": "Malware payload", "value": "2543872b6ce376a02c5c1f81b970eb74", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646860853, "uuid": "5936eba3-87e2-43ac-836a-fb3df47e4814", "comment": "Malware payload", "value": "07438995cd171ff76ddc6e66ff3d00e4f8b2ddc427d099e464f9cf169b755b47", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646860853, "uuid": "e2ae071f-312e-4c4a-a3b7-02280658513d", "comment": "Malware payload", "value": "1a2e7e4462085eb75502d1f1394895a75ff31724", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646860853, "uuid": "9f2024b5-e65b-408e-91b9-0fd816e38bf1", "comment": "Malware payload", "value": "82863a92d6b7f5fc97d1b460d0bf21e1285476dd0d72a0222f2d87430190de07370baeb03ac0330047d4e59b73e40114", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646860853, "uuid": "9617d480-3397-4e33-8c96-2dd39775ccc7", "value": "T1D815BE12F5B0CAF6C13216749E4BDBE81522BD242D285C673BD53F4C8E7A782393529B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646860853, "uuid": "451ccca0-725f-4a87-a802-4a343a550050", "value": "f5e2fae08fb1c8fba965c988eb10e880", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646860853, "uuid": "ef9da376-7204-4eb0-a416-3f8d14e93c9b", "value": "12288:8uPUTLYcAaUMhUhLupXshh1PEd5hOonifqYwNCOKnO2yfDm:8uPmLDUMihIXCE516qYwNkg6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646860853, "uuid": "f9da941a-eade-42d0-adc0-d8c92fd87da8", "value": 961008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646860853, "uuid": "98d50d25-757b-4013-938b-edc070359f6b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646860853, "uuid": "dd24b5d7-6efa-4c8c-91b7-1e18044faad3", "value": "install3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ce908bd-9fb4-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1646835727, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646835727, "uuid": "2a7349a6-7237-4e76-9bdf-1c42af698576", "comment": "Malware payload (Formbook)", "value": "cec65e181772ad00d14f03fefb342e7d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646835727, "uuid": "899b6a88-d83a-4a81-81b6-d5908352e4c5", "comment": "Malware payload (Formbook)", "value": "078559092efe7665afdcb9aace0a5c76d8506f07832db7f83f72ad56fb572add", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646835727, "uuid": "5547f155-9bc8-4441-ab2b-933d05c79cde", "comment": "Malware payload (Formbook)", "value": "933073932a23d540b0504a7c23101b07d07444cf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646835727, "uuid": "83a859e4-a354-4231-9ad4-f15dcc4653d6", "comment": "Malware payload (Formbook)", "value": "007876f728c123e845dfaa3159b7e721643b42e346bd0ef0618f6f49774ed1d1cd7691169375806bd2f84ef33411bd8a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646835727, "uuid": "c828c78d-bb3a-4167-a43b-3ea38c021bb9", "value": "T1C3C4E009327286D6DA78E7780C61500CCFE5EE22D34FF2BE7C86599C10B4B5B0655EAB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646835727, "uuid": "82755642-dc19-40ca-bc67-9e668428cb3c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646835727, "uuid": "9107aa96-5342-4503-b0d6-a98dbbdd3fd1", "value": "12288:dRXRUcZ647JEEEEEEEEEEEEEEEEEholUI8s0OLPInLn6xYqTkpUxO1xAmKgVtt:HBUqEEEEEEEEEEEEEEEEEO2U0OLPc6vg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646835727, "uuid": "0392da11-0ddd-40fe-8ce0-5f2933a10b63", "value": 571904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646835727, "uuid": "86e8b300-4675-4bf7-9d03-49790a73e42e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646835727, "uuid": "0ead7d56-cfeb-4faf-93cc-9fe24a55982a", "value": "Swift copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b210766-9fba-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1646838328, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646838328, "uuid": "bed689a1-c889-4f88-b287-d12bcb166b64", "comment": "Malware payload (AgentTesla)", "value": "7cca872de551237981ae756498350ce7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646838328, "uuid": "7cd0962d-4696-4955-a04a-ea4a40049a90", "comment": "Malware payload (AgentTesla)", "value": "079bd477f469259995c11bf4b2de9f88bf2a238504528dd18bfc06ab12b4e9bb", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646838328, "uuid": "b1eb0166-6e5b-4db5-9c32-90fac594c0fb", "comment": "Malware payload (AgentTesla)", "value": "8b48a70b204ccb76ce70243fa5ce06a8e9799a92", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646838328, "uuid": "229779f2-1c93-4ba1-9093-263d8b456f8b", "comment": "Malware payload (AgentTesla)", "value": "c83959fd638bb7d039876bc61f62c53d2d1be4ff8ec7087f66eb50c3d1915b2701293ae2e494e00eb01ea9a144923c2b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646838328, "uuid": "c408f387-fc47-4893-ae8a-1986943f3982", "value": "T1661533D1C8DFC8F8E7E89D34F6152A89F785938D23378470208552979F8922FBAD209D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646838328, "uuid": "981eda13-5f63-4b4a-9142-b3ec38cacfb5", "value": "24576:24OfCDSvPV6ITg+6N+fYbuZeOpwXaQVDfOnjkyRpQ06:24OfLVjE+6QwbuZNpYauKXRpt6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646838328, "uuid": "57df9324-32ea-4cec-b62b-285677a9cd81", "value": 908716, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646838328, "uuid": "5600380c-9e21-467f-a445-492ba9ed5759", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646838328, "uuid": "69a2763a-0e83-46f0-b870-e6a3e746524a", "value": "payment copy.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4dc0733a-9fe9-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1646858492, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646858492, "uuid": "a153b17a-7e06-44ba-a119-874bc1a477d0", "comment": "Malware payload (RedLineStealer)", "value": "ac9046ef00d2cc46f812e16ea45eb9fa", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646858492, "uuid": "366f5739-7fff-4aa0-be77-3999466882c9", "comment": "Malware payload (RedLineStealer)", "value": "07c04fc17e8b108b50ce6df04776473931f084cfd63341440e1a5cd554a49a50", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646858492, "uuid": "6534f08d-2a1d-4750-acdb-d5032d49a6b1", "comment": "Malware payload (RedLineStealer)", "value": "98762a3ca53623f8ff70992cba3651bc22626af3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646858492, "uuid": "688e4d04-ef4b-43c6-8f87-6c7e50cf6fc0", "comment": "Malware payload (RedLineStealer)", "value": "f2a4e0ef645339e78415d95b0d92bfeee1e95d8c55078a0464be603f937135c836c1f05b7b73771d56c301bf161d024f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646858492, "uuid": "984c36e4-92b1-4147-a127-f451880b63dc", "value": "T191C4239F3381FA2DC96F2AFA49B2DE4CE6B5BE1093C4180366748B82925C056D71D4FD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646858492, "uuid": "25741688-ec99-4516-9a19-6548a95a3d6f", "value": "445554923421947cbff896012e27345a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646858492, "uuid": "be397fc6-c693-4ac3-94c0-6b387c200a38", "value": "12288:6Y+aWDmyfy2by747NQS03ULaHNqrxlKIQNoVxG0lI8YSerq19Rg:b+Ppny747NkEaHNYK3SNDY4g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646858492, "uuid": "7bf082e1-986b-4277-a084-dc9329e3a8d6", "value": 570368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646858492, "uuid": "a96f9c87-68bd-4d98-a747-5f3c0b4d975a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646858492, "uuid": "e85d371c-449b-4561-b2f4-dd006424ccba", "value": "ac9046ef00d2cc46f812e16ea45eb9fa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe31b79c-9fc4-11ec-9275-42010a9c0029", "comment": "Malware payload (njrat)", "timestamp": 1646842896, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646842896, "uuid": "2ff09f37-aaaa-41b2-bc37-048edad6ffd0", "comment": "Malware payload (njrat)", "value": "27de9fa03f4c3950e07c978ae4251c75", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646842896, "uuid": "5c1444c0-9028-43e7-8287-181e4220370b", "comment": "Malware payload (njrat)", "value": "07c7268c2f8a736f5c74f9dabfdf5e10c8a4580fdfcf11eaa7e20a88dd52cae8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646842896, "uuid": "e54ed324-5070-44c0-9371-f0cc47c5014a", "comment": "Malware payload (njrat)", "value": "d194c4d64582b2d4b86b099429c3c31172744ec4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646842896, "uuid": "f842547f-5620-46d6-afe4-1d2deced3384", "comment": "Malware payload (njrat)", "value": "3cb81a41ed3d8bd6c13f30afa39f9235d062058b9a030879739c946fcab010d4314ca49db8fc2247119652e52c064714", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646842896, "uuid": "08df53a9-662e-4282-b466-bda96a5430e0", "value": "T1F3C27F12B2B85223D16E07F858A652CC4BBD6CAF2521E7D91D4071CE6EF6B4045F3BA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646842896, "uuid": "9993c1a2-a598-4fbe-b13d-db0048169c79", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646842896, "uuid": "5b4e2ce2-5620-4484-894d-05bcb430547e", "value": "384:KhsRBp5Ksf8dYsi0vSNx6N0DNdOEg5EGvmYaRdPNxkHgTZ2yR:KQ7KZHANx6yovmnFR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646842896, "uuid": "8ebac804-2ac3-4747-8271-6cc38a08bd9e", "value": 27136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646842896, "uuid": "cabecb73-07d5-4cd5-86f3-7650fde240b3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646842896, "uuid": "6166069f-4afd-434f-8996-68b448d195b0", "value": "27de9fa03f4c3950e07c978ae4251c75.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b5d6867-9f89-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1646817202, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646817202, "uuid": "0e8ebdbb-5a30-4fae-ad51-659b07447a35", "comment": "Malware payload (AgentTesla)", "value": "d1f6c8cccbd4ac6f3144b93826ebb4f4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646817202, "uuid": "366e9b4d-855a-4265-b507-2e39febc4f61", "comment": "Malware payload (AgentTesla)", "value": "0805f2472ff54050278424b9e0c8dfbbe93cdae6a4cd417341c85a5fbe4033c6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646817202, "uuid": "b7d33532-4957-4543-8c66-55ee77cc5fe3", "comment": "Malware payload (AgentTesla)", "value": "bb4898443eda28cca3bff011daf54cc70f05b7f8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646817202, "uuid": "2596e27f-a16b-48ed-adec-293629a8be31", "comment": "Malware payload (AgentTesla)", "value": "0f7aade559a071e9b18f88718f0bca8185f1ce15f66c645054eec4d48a1b6c153d6110ecfd44f5523bc798f817a0ee17", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646817202, "uuid": "3cc690fb-1703-4cbc-b097-73aa7dc69632", "value": "T1D6E433E44F4F4120D14BDABAD3DA972650D465694625EF9033E830FEAEF1B8035AB2C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646817202, "uuid": "66764c28-04ea-4462-b318-432ead2a61fc", "value": "12288:xxW3FuNrZTaeNzUmjNQYMsbhC/ZrckOwZxpokKnhQY8wCdgtS:bW36FLLHbh8ZcFwZHokKnhQY4CS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646817202, "uuid": "de86e184-05ab-4f80-a721-51c7eca6d0ad", "value": 664535, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646817202, "uuid": "be3711d1-e690-44d1-bde3-414dc229fd26", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646817202, "uuid": "8a1dd9ce-cb92-4b35-a675-f8ba48f4cca6", "value": "Overdue Payment.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1073c003-9fd6-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646850228, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646850228, "uuid": "21056743-c41c-46fe-8932-843be35919c4", "comment": "Malware payload (Heodo)", "value": "1a65ed2e9388f233c51a78b5a9b690e9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646850228, "uuid": "ea52519d-1221-4626-8413-b80e91892255", "comment": "Malware payload (Heodo)", "value": "091860d99c8aa1faea8487a835bf086927e9c704ef8c5c0e44209b73e5e63543", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646850228, "uuid": "ceca709b-a3dc-4f56-8bde-856be9af9a29", "comment": "Malware payload (Heodo)", "value": "e7e77326005fdded450af95955451e0624368dd4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646850228, "uuid": "b3d2a6f8-02cb-46aa-a07f-36c7f1d0a191", "comment": "Malware payload (Heodo)", "value": "a571fe2ec00af48b2cba79735f1d6c4b9a13e94d8d97de1f43dc383c1d755fc2ffa745a4cfc24fb3210265783162c027", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646850228, "uuid": "3e763bdd-af73-4e54-a9a3-c73b176a2f51", "value": "T176257C107E8A817EC71B85B30836676D6FFEAB204B6CA1CB478175ED2D316C29B36705", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646850228, "uuid": "47bb8f46-b8ed-4e81-8c35-88e94444213b", "value": "087c9809507dfca4c3283e6c7539e91c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646850228, "uuid": "0a73db5d-49a1-48f8-bd12-47c5e4d418d6", "value": "12288:cR5SOyRHiA6m0OcElqzt6JtcS1j2xKkr:cR5SOrKlqzEtcK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646850228, "uuid": "a9391f08-d1fe-43a1-9144-914c60e5b634", "value": 1040384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646850228, "uuid": "5ff31b03-4532-493f-8729-f368f55554a5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646850228, "uuid": "5e54ad36-fe8d-4920-a522-5f9566d3d4e2", "value": "1a65ed2e9388f233c51a78b5a9b690e9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89a7b585-9f82-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646814354, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646814354, "uuid": "0a760e85-ed18-4728-a6ed-c810023680c9", "comment": "Malware payload", "value": "8ff0029501c5f0f95c1ec5a8bc0c297f", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646814354, "uuid": "bcc5a5bd-6f28-48b2-8b66-868f804424bf", "comment": "Malware payload", "value": "093dd7785e53de661ea366603b5ab46f91ef06a105e2afdbc6235f484c5552d1", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646814354, "uuid": "aefd7396-d308-49e9-9dae-7a0063e4a2d2", "comment": "Malware payload", "value": "edabb5cbcdb863086a3436ba26f8c5d3d218cf70", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646814354, "uuid": "8fffe250-6d11-4b73-8b62-b4544c8b05e8", "comment": "Malware payload", "value": "0a3225021250eb090a33c42451ac629836d97d54ed5d47bcfacf442cc03cb8542679c9b9683b2fe29bf9310a3c0ff255", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646814354, "uuid": "a23584ad-296e-4e3d-ad8c-29fb90427360", "value": "T1D6B2D0E7C6B6D982D1072AFEEA72411409AE7D44A70DC15FC3727C4D1B35C20EB2BA61", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646814354, "uuid": "efa5b881-cec8-422c-8d52-6cc34db71ecb", "value": "768:9wylvBtI99ROd/RHeGwQx4U9BsBc7754jtz8:9wy1BtI99ROd/9dw6c05gtz8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646814354, "uuid": "54ac8b19-f413-44c6-81a5-633f87bcc076", "value": 24680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646814354, "uuid": "53dfd175-972f-435b-8ec8-63219bdf5597", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646814354, "uuid": "8dd61dd2-cd00-43cf-8226-12251c86b2eb", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7dacbb3-9f9a-11ec-9275-42010a9c0029", "comment": "Malware payload (Quakbot)", "timestamp": 1646824847, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646824847, "uuid": "03ad39a0-6332-4f2e-8ab9-40ab248c69aa", "comment": "Malware payload (Quakbot)", "value": "7ca1aa9782f1a809e0c2ab7832542bc3", "object_relation": "md5", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646824847, "uuid": "43dc14ba-becb-4387-8749-4308180f4268", "comment": "Malware payload (Quakbot)", "value": "09fcfe7a67616b7a5dcebee89db48f98053cd2fe147f2459a4f92d68ad599a5a", "object_relation": "sha256", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646824847, "uuid": "addd399f-acba-4959-8c2c-4076e38ba518", "comment": "Malware payload (Quakbot)", "value": "c43543f0900b59bb74be4ca58d55bd89a2e2f600", "object_relation": "sha1", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646824847, "uuid": "91154bc3-e786-4753-bdb8-e5457efc29d7", "comment": "Malware payload (Quakbot)", "value": "2764ac4c036b5ac9e6e4c721e86a1c68e664b1c6357286d0333f8427aabab37cfda67475b6c5bae6955e573ae6ce30ec", "object_relation": "sha3-384", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646824847, "uuid": "f400a15a-92e1-41bf-b776-30fd2e0a2de7", "value": "T10A34D092859555B6D1EEAB7023424CD1C1BF306AFC0AE816178353FB3A022F76D992FD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646824847, "uuid": "70298ce1-d999-4886-ab99-5b4fcbd44e1d", "value": "3072:9V5YTPZav/2I01sV03b5R228Driy4EtLa/3WumKrDMzzwJS/wiv+jfcxmpOX3gLw:9V5Eusjr222+yXNQ3MwwdofaVE2/R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646824847, "uuid": "fca48641-61bd-4638-9659-6c4a34d3ac90", "value": 239374, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646824847, "uuid": "8923fd09-02e6-499e-ba9e-1f3b2bda4979", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646824847, "uuid": "9e387a99-f65c-4234-9f01-d2da0d3ea86e", "value": "fueaserrpcedinacusms.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "791c20ce-9fec-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1646859853, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646859853, "uuid": "c87a8b4e-caa2-4f06-824b-949f5e7b4441", "comment": "Malware payload (RedLineStealer)", "value": "60db14932b74f17e3e7ddefbcfe3f507", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646859853, "uuid": "872f03eb-b37d-43d1-ac81-36608804e8cd", "comment": "Malware payload (RedLineStealer)", "value": "0a149903280e1ac386d0699b96972437b7f8e2b2fb637d10029a9d27515f2bb2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646859853, "uuid": "0e37a245-a40c-4ff5-b026-933a72cb9ec8", "comment": "Malware payload (RedLineStealer)", "value": "85ee313c7ecaa92837ae1bc71d283c6a41f75170", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646859853, "uuid": "0fd409ca-ec51-4cec-8783-9c3fbaf781af", "comment": "Malware payload (RedLineStealer)", "value": "e57eab7acc14cbef594c95061edaa30fde634e493586323f98d50dfaf1fcc4f8b67a606d5946df497b73c56f4bb6e4ce", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646859853, "uuid": "eac92217-46d6-4db5-8b72-83d7871a7c7f", "value": "T19CE1B616A7E84776FEB70B329C6262500774F702AE63DB6D94C4120E5E6730147A2F36", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646859853, "uuid": "b50a89e0-d646-4049-9dcd-696c1b1ab555", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646859853, "uuid": "d0eb4846-8d81-4ac7-8e8c-37e958557d76", "value": "96:dFweO+psHlPZ6q1pSi423RwhntIFnKgnPpSepUpDScxG1KczNt:d+CeHlPAqGtEyWnxSvtS/Em", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646859853, "uuid": "71daef76-289e-4757-b233-4acfac243bec", "value": 7168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646859853, "uuid": "389f987c-24a0-4cc4-b35a-e52d311784ee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646859853, "uuid": "ea986b38-2149-4d5a-b469-4bc0401944fe", "value": "Tutorial.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea760281-9fbb-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646838998, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646838998, "uuid": "767d54d4-11a6-4bac-b48f-80f436e75b9a", "comment": "Malware payload", "value": "e3523f5491fb7ad900a96a5d156b19b8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646838998, "uuid": "a130e894-f3d3-40e1-96d1-972572be19c8", "comment": "Malware payload", "value": "0a680598e3a8d96c26fe09ece0775b2c7e17243c6b6b74c0f8fcfbcc9e51dce5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646838998, "uuid": "d77fdece-3af5-4117-8f09-627eb203d40a", "comment": "Malware payload", "value": "446ebc6b5dfe174e0f5b7f09d53d1268a98829e4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646838998, "uuid": "e0934864-ec67-48d6-821d-681f562e7ee0", "comment": "Malware payload", "value": "9c1ac8a2416d7e44d717a9013b2aa3b72fef8f82aa3d712a2d769d81b08ef251dba24dfdb8bb60cf4255fd6780c710cd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646838998, "uuid": "19484419-20eb-48ce-ac0f-ea76059ce097", "value": "T181C533AF0407667AD9807D38973CFFC426886473462138251D2BD2E82275DF2EBD6B67", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646838998, "uuid": "552475bb-96bc-476d-a094-ebe10964b2c3", "value": "49152:ewE8J99lxhYV7npeOSaQ++9VHvggT4RSMSLicvE/rn1ucMSsIqkG1zHzPbabB5GS:eH8J9bw7npeOTQLjHYkANSBYnUSsIqkR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646838998, "uuid": "7e48958b-95af-49c1-84e3-5ad6f86e4edf", "value": 2532492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646838998, "uuid": "4c63231f-46a5-4c56-aa72-c71b6dd865ce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646838998, "uuid": "a291e65a-9f6d-4d41-82e6-5d1b5106fd2f", "value": "e3523f5491fb7ad900a96a5d156b19b8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0125dbde-9ff3-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646862658, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646862658, "uuid": "83ec10ba-252b-4612-9996-c1852691ca80", "comment": "Malware payload", "value": "1af9273b51d818f56e9b2442d27ae8c1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646862658, "uuid": "b35cbdf6-e3c2-4973-91c9-0908348f6156", "comment": "Malware payload", "value": "0ac87f553cfa5064f5842f568f2ceb249c3b68b5e743f10ab4455cbde7c7395b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646862658, "uuid": "7a7c92a5-1f2a-4c25-8e02-f3752de408fe", "comment": "Malware payload", "value": "420fe472a9d15c28806130a17f5feb258964956a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646862658, "uuid": "ed8b82ba-75df-409b-9761-16b9c2c4f397", "comment": "Malware payload", "value": "7bd8f433fef82bc4cfda7dd063d95fcb1718d051cde05a8472d217f1d6478dcc2a94fefe111292e6e23d5af1b3da95f6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646862658, "uuid": "48796b3f-af56-4c88-9c8a-f21dcd83738c", "value": "T1283633E7C2B08CA7C76AB174005B21B97AC26301495391B3A81CD53E5BBF59ADE72C27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646862658, "uuid": "0c6d82da-3932-46ac-85a2-7a7710ca837f", "value": "fddc083fa31a17c938d0a17ec7cd3025", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646862658, "uuid": "e5cf69b0-fa61-4dd2-9af9-a4fb88b2b0f8", "value": "98304:u/Tdbg8K6VID8cOLfthn5FXHcVZnSqJq8aa94BPVS7GRVQcVJ/hXZ765CJdTSckC:EtgYuKLVhn59cT74BdS7GRVQaTJdTNkC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646862658, "uuid": "442abfa3-c65a-4f7f-9551-08911f4969ef", "value": 5155632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646862658, "uuid": "88b688ac-9831-42bf-88bb-1cda2204df31", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646862658, "uuid": "47e04055-202f-4228-a91f-a16dd6c0e684", "value": "SecuriteInfo.com.Trojan.GenericKD.48421112.31829.17902", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1bdaa78b-9fba-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1646838222, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646838222, "uuid": "2c86421c-7bda-4432-912f-b1fc9d681e61", "comment": "Malware payload (Loki)", "value": "98a8090d54639b9c4bcf93a682334890", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646838222, "uuid": "fa28987c-d5f4-4453-8854-261e64389616", "comment": "Malware payload (Loki)", "value": "0b00074271c6df97cfb3e258bb815fea2ad98bbb9e1670c923432c231dd73402", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646838222, "uuid": "1b125a6e-582e-49aa-b331-8293c7eb5228", "comment": "Malware payload (Loki)", "value": "bb3bf5b84fe7f5d5a97b38c94a85693398b51a7f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646838222, "uuid": "73a80685-598c-4f76-b6e1-35166a1656a8", "comment": "Malware payload (Loki)", "value": "15cb9fc0474421f553a9e4189bf6826ee4709cca92166d6e4522f9257c207f70c9dbea21e5b68043edadfc624608f2f6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646838222, "uuid": "a8b29bbe-55c6-4035-9a77-60e478a27b8b", "value": "T1C3F4C73D9E9BD809D1DE4CBCA2BFCF489059081C49BD0823EE17782B4AB6ED5B35B541", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646838222, "uuid": "9eaa6f48-2b96-4659-9baf-f2675468d15e", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646838222, "uuid": "48c93393-125a-4c57-ab5c-9a8ed15f660a", "value": "12288:82QsfUwXvEtBuQ4tzKpW1DY3xbsjERKn4:9FUaMtQQ4BvZYGjoK4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646838222, "uuid": "91082dea-a6a1-4acd-86a8-612edb2a6d80", "value": 742824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646838222, "uuid": "3bc73341-80c9-4116-845f-a7c399267897", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646838222, "uuid": "1e57e0ed-57f6-45d7-8db0-95da9cf7b2b3", "value": "vbc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3762d3dd-9f93-11ec-9275-42010a9c0029", "comment": "Malware payload (CryptBot)", "timestamp": 1646821517, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646821517, "uuid": "98c6b855-18f6-4a14-bb61-611221c667aa", "comment": "Malware payload (CryptBot)", "value": "e9b19ea424dbfe48f7cdce345e35fe18", "object_relation": "md5", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646821517, "uuid": "e22a06d9-ba57-4883-a2ad-7db47d34040e", "comment": "Malware payload (CryptBot)", "value": "0b677704afb6326b65063d8141c34e3a5cf82f2fae03990e04b08dc3ad796c22", "object_relation": "sha256", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646821517, "uuid": "9a52b22b-9cb7-495d-97a3-70cad48a1c3d", "comment": "Malware payload (CryptBot)", "value": "058444dddb16aeae9f71a3b05b0694c63638936f", "object_relation": "sha1", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646821517, "uuid": "d23376c5-0c55-4b67-854d-c8ea977d1aec", "comment": "Malware payload (CryptBot)", "value": "69e418787c7554e7ece0ccbfc85bd6ed91e327b8f8e6704c54c08125858bc50ce0771807cfba82f063bf1086ee19030a", "object_relation": "sha3-384", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646821517, "uuid": "f03109ee-02a1-4e9e-9817-47003d4e49f2", "value": "T1F28533C46C4DD1F0A180ACE057A97D350B92D1EB4CF7EA830B53B68A19E52EF873C995", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646821517, "uuid": "e29f6d60-e419-46af-af93-602800c48d21", "value": "49152:RnBVcL9XaAdFDv/FPY9bmRoKJLkOEE9+Sztifd3UzBSKh8py:RHcVaA3v/KKJLZEYc3UlSry", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646821517, "uuid": "9f735b3f-cd0a-42c2-b0ce-559d1a98380c", "value": 1821807, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646821517, "uuid": "f8dad1e1-7a32-45d6-954b-c243f01b08ef", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646821517, "uuid": "f21f745f-ea12-41b1-b08a-c120aa302b97", "value": "910950e2-2cf6-4af6-746e-38e7d3533601.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "421aaafd-9f80-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1646813375, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646813375, "uuid": "061265c6-1f48-4206-8101-c636d2bc3746", "comment": "Malware payload (Formbook)", "value": "559dcf4c8db7d24f49121668bc259265", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646813375, "uuid": "f601188f-39b0-4381-ab73-aa7f72f6a44a", "comment": "Malware payload (Formbook)", "value": "0c07d0cc580594b0ed9ce95eec9747fdbd4ffa2fa9bfa00284d05c8890785b9d", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646813375, "uuid": "b919f038-0e65-4750-9758-28a35facb437", "comment": "Malware payload (Formbook)", "value": "34deee6a61ef14a188fe4da0c29cf38ed79fea6a", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646813375, "uuid": "00fbc505-b908-478d-b6a2-c1b9c86920cb", "comment": "Malware payload (Formbook)", "value": "c32a5e7009361dfb8534826f4f6e893d1ba9057b849ee0667f1596a0573a597346fd97cbb23139714375dd53fcf54867", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646813375, "uuid": "09e101ff-cfa2-4b10-9754-1a73eff3cc6d", "value": "T188E423527B37F5A2A2FFD4131C6C142611D61CDE5B29F0E13B627E4A2B5EA00F48AD4E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646813375, "uuid": "d88ac7d1-bee2-4fe9-8326-30abe3494ac2", "value": "12288:AXO2wVFlYIgwy/ljpPR2viIHps8/UMaBzVQ5xphfI2rfEylicHGqEi/aMNEksv:EO2g3sRmiIHa3Ma/6xlrN/GJsNW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646813375, "uuid": "5d2cb1fa-e4da-4920-a421-97cf8c70b841", "value": 711912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646813375, "uuid": "df48487d-a13b-481a-89a7-9c2e59057ac2", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646813375, "uuid": "20b11d9b-03b7-4533-8c25-b6b894227b3b", "value": "PI.r15", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51e7c067-9fbf-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1646840460, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646840460, "uuid": "ba170815-6b5e-423d-a858-fc8da02ded63", "comment": "Malware payload (Mirai)", "value": "2bea45f7d9c7daae3f0091f97ac750fc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646840460, "uuid": "ad3b7022-7590-4e58-843a-2abdd51355d1", "comment": "Malware payload (Mirai)", "value": "0c2552dfc229eb665911f32185ab5533479afc567c0150ce25a03d12140374d0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646840460, "uuid": "7fc6f4a5-da21-4f86-b048-b77110cb1ef2", "comment": "Malware payload (Mirai)", "value": "c58046c88952c92c3c3dc94c82e9ffb456e919d1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646840460, "uuid": "f22ceffe-f31c-437d-9410-4baad0e79fbe", "comment": "Malware payload (Mirai)", "value": "aa598dc4868bf23926044851f41d84b21b98c69e24329ea27c136bc6cc4ab670b271621c2450e8833a8e56fa2254b4b6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646840460, "uuid": "dab77aa1-4d13-4d22-92f9-654f8009a99a", "value": "T185A33AA2F850EF3AF40A823E046B6902753093F51BD15F76B7D235679EB61C11963F82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646840460, "uuid": "46783332-8226-427d-9361-77835f2b5fbe", "value": "3072:aAZc4kuVsS9csdWbyVqC21jSwZskBzbVWWVi5s21L+SFbNQW/thXVaEF6/hrUKGF:q4dEyCo7x3yadTBJ3IM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646840460, "uuid": "aeff7076-c6f2-483f-baa0-90c88c780a02", "value": 103072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646840460, "uuid": "871b9505-b747-4bd1-90fb-4cf4c68e01a4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646840460, "uuid": "4f2007e1-20b1-422e-bcaf-ad063891a00e", "value": "2bea45f7d9c7daae3f0091f97ac750fc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16e381ce-9fd4-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1646849380, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646849380, "uuid": "29eccad8-712a-47dd-9719-1a4c1cbe4bc5", "comment": "Malware payload (Mirai)", "value": "c415ab355987147c9f153dd3f0bfae84", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646849380, "uuid": "66769688-df5f-434b-b3e9-2464057b1093", "comment": "Malware payload (Mirai)", "value": "0cebfcde16fefd85f6d140f0ec6883fc53be5851b54c6791152447d8fb3cd29a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646849380, "uuid": "d3d47e4e-9292-4c14-8f52-4b98fbb5e6dc", "comment": "Malware payload (Mirai)", "value": "b2bf1eab780c69b99361fa8d616eb436a7dc1237", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646849380, "uuid": "6779fa6f-86ca-4925-b7a2-8c2fe202f121", "comment": "Malware payload (Mirai)", "value": "38fbdd5123f081a5e67094ccc9f8aa92965b842a5b744528aff551b097810102ff7a8b81c9263dbdfd178a46b19a1b49", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646849380, "uuid": "c42cfb55-f7d1-454d-8d6f-8b99b09ae4dc", "value": "T12773840E2E619FBCFBAD863587B35F209258339226E1C545D19CFA011E7034E746FBA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646849380, "uuid": "3dade85e-9851-4ba4-886d-b1b0d0bcdef3", "value": "1536:G4Z8LUay6+vl/R1KIdysUmR9EiYHXw22Rl1OsghNtJjzETD:B6ry6+vdGIdysUKUAl1OFhNtBzID", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646849380, "uuid": "57175764-097f-4589-88bf-74d8c81a42b0", "value": 79804, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646849380, "uuid": "c5517387-b0aa-498e-b96e-3c788d42c235", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646849380, "uuid": "566420ff-729e-4754-afa8-60f68a3208a0", "value": "c415ab355987147c9f153dd3f0bfae84", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e6088f6-9fbe-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1646840051, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646840051, "uuid": "0ad79f7a-d73a-480a-8741-3aafbd74fa52", "comment": "Malware payload (Formbook)", "value": "c925a7030ea183d7f9871d471eba845d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646840051, "uuid": "45ad19b1-905e-4b0e-853e-fce6741311c7", "comment": "Malware payload (Formbook)", "value": "0d5cadcb87d74ad3b01d6e9fc3e2537391ccdc99f49f724bc33f60bb498b953a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646840051, "uuid": "edab17e8-a9de-4472-ba8a-9f24d213813d", "comment": "Malware payload (Formbook)", "value": "229733cb65fde953a539d07dbb962e0b82a8534b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646840051, "uuid": "f58c2e05-f7cb-4e1b-b831-14f1c502910a", "comment": "Malware payload (Formbook)", "value": "47ab48234403b16f9aa830c963c20d816cc884c4009e9c1aeaa311db0db1cb1b73a1b2947bdee56cf22ea63d506492de", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646840051, "uuid": "38d20efd-04d5-4af2-95e0-69cda12d09fc", "value": "T196B412536F80DB1EC87554F2D1EBEAF8ABB0591238514907AB903F3F39B538E5429287", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646840051, "uuid": "8beb6c49-7434-40c0-b4b5-b7ddbbfa9872", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646840051, "uuid": "8797b7f5-1576-4be8-ab3c-93e386fef895", "value": "12288:3wnXhyNKIM1svbTkEMp+T+tzjUC80OJYwZJPy5A:3wnXsNPM1oTxTgzjUP3hWA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646840051, "uuid": "ce04cac8-6789-4cde-b65d-05748a0bea64", "value": 538619, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646840051, "uuid": "3aa00653-1ad8-465a-8c9b-13cd7a11c4fb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646840051, "uuid": "6b0c458b-4f36-42b0-b9fd-a32b10009ec6", "value": "Order CIF11023.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aecdab51-9fb7-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1646837180, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646837180, "uuid": "551f995e-7975-4727-b1c2-ef2d18d4f8c8", "comment": "Malware payload (Formbook)", "value": "a157067af8617cd35c70f2b876d644a0", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646837180, "uuid": "361a107d-a459-4d1d-9f0c-fb815400bf6a", "comment": "Malware payload (Formbook)", "value": "0dcf2711de81179f1373c5df71acdb776c82eb4470c4c9e607276387681db39f", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646837180, "uuid": "ec553d95-9137-46af-ab04-395d2e0bca92", "comment": "Malware payload (Formbook)", "value": "c65c91f1b340ae0e1ab2ed224c9bf70fee5b8165", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646837180, "uuid": "f812b1ee-a076-450c-b665-c3fb8ab9e747", "comment": "Malware payload (Formbook)", "value": "7c621daa05f25ab465bd19ce90b16ee18b30e162cf17f0ea72ebbeee9d216dce020b5339b573ad2dcd77d64afc5c44c4", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646837180, "uuid": "73ba8b49-9f90-4db3-8487-eeb6f69f81a2", "value": "T1D61412307D146B26E5F0BAB4CCE599851A2DED2EF604F266A0447E49FB398F00537BB4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646837180, "uuid": "fc32bd75-f4bf-4915-9ee5-b5354dd43ff7", "value": "3072:JEE0G5aVbOiMaUyJiswqs0wnDjZNHJeXoVu0m6XjBs1DUfAuHLJsk0KoPrQv4o60:D0QdaGNxNcXoVuXD741sk0DPrQv5R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646837180, "uuid": "f2d768e7-ec66-4227-9d54-8b0acae349f1", "value": 190792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646837180, "uuid": "80e9031c-b99c-448d-bf2e-7f4d5550915d", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646837180, "uuid": "bd05b1e3-fba9-4b60-a3cd-777a0f8e38ef", "value": "SHIPPING DOCUMENTS.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3125fc3-9fe3-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646856112, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646856112, "uuid": "17a82fab-a8bf-49a6-8ffb-0008726f9f99", "comment": "Malware payload", "value": "14272291438efac58308397d8a016459", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646856112, "uuid": "dd00a43b-e79b-47eb-be9b-da274a39a9f7", "comment": "Malware payload", "value": "0e22f42c7121ad7bd94850929efe4e42fe7cc13808f5404a3a864b56bcfcb49f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646856112, "uuid": "e1009f78-ee4d-4263-a0af-e4456ef2cf8c", "comment": "Malware payload", "value": "b8eb83112b57ec770e45c1f1bdfd9e0eefba9e3e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646856112, "uuid": "938dd992-460d-421d-992a-f890a8f66b9b", "comment": "Malware payload", "value": "7efc3d4df820ebc18c8bc0deaf0c7f6b65c48c85570739bb1563542ab06f275fd410378d6213fa4f9b831d17524a9482", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646856112, "uuid": "57c642f3-0aaa-4bb5-8813-d8462f946f80", "value": "T134A423292B116381D8B3E37AB4A2B7C94B36D53266AF03F9B04D169DBF115274731C72", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646856112, "uuid": "01f86cae-31d3-4df7-83a3-bc9397b77147", "value": "6144:7bB5bUnsIAKQNFgdrMDQVBBsensVcjWpa1LjAI9wroOUaGeKNkWaE1uH9+kH24QA:RG5MKdrMMVB6xVc6pS8YaGebEX0p3d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646856112, "uuid": "0da8dbe4-5a4c-4d07-bb18-15ebe7790334", "value": 464896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646856112, "uuid": "b0695a53-a4d6-4316-b438-008ba7602ddb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646856112, "uuid": "bd4f5012-9888-40a6-87a5-377369091c7b", "value": "14272291438efac58308397d8a016459", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fddcae02-9f95-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1646822709, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646822709, "uuid": "82fa2e1b-e4ca-4e0b-9f94-d33e0c7253fd", "comment": "Malware payload (Formbook)", "value": "2437236f8d10cf09961dccc847f8b284", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646822709, "uuid": "b3534b72-f884-4ba8-8fdb-fe5b5579a60a", "comment": "Malware payload (Formbook)", "value": "0e39ef64479fdca265d7a41809af208aa2720d8d3895187b5f8f7ea5370018bc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646822709, "uuid": "e309c694-7953-4722-abc2-280360f42147", "comment": "Malware payload (Formbook)", "value": "7eb908c9870c5d79b0a74c68c2c59602cd97c302", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646822709, "uuid": "b6755361-f9f2-4b7d-90ae-51a697d00e7e", "comment": "Malware payload (Formbook)", "value": "d4ad7ba5c10153e770516b31203fa446b5fb92c7e19f6094bf6bb71b642abcdfc6c5a7d6238e64070f10103c342b10cc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646822709, "uuid": "c58dc25e-3414-44a8-a595-ecbfe4f62993", "value": "T134F4D59C312031DEC96BD6759AA81D68FFA03C7B831F511B902731AD9A7C987CF245B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646822709, "uuid": "c2f469ec-4305-4e8b-8a51-50044a85656b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646822709, "uuid": "e06b4f72-d3a9-47cc-8a2c-273f22caa5ec", "value": "12288:2rRcECaZ+v0AkwL9gUAyjtpZziLI0cZmfP5erBl6ZlCurmwl1eue4w7k0QZXN9Tu:2OEmvx+TyjTZMcIHErXU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646822709, "uuid": "126acb62-d024-4068-92de-8ac81fdeb65d", "value": 743424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646822709, "uuid": "b5199510-3231-4004-99db-24191ac2427c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646822709, "uuid": "fccb4476-cc14-4d36-81fe-5ca8864724de", "value": "Product Catalog and Price_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "626b1352-9fb2-11ec-9275-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1646834904, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646834904, "uuid": "e298464a-d6b6-45bb-a6b1-9a26cabe2c9e", "comment": "Malware payload (SnakeKeylogger)", "value": "04c8875e076593fbf66c968e11f19bd1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646834904, "uuid": "b0fd5655-362e-4233-89a0-4f8c644fa964", "comment": "Malware payload (SnakeKeylogger)", "value": "0ec04190bd728a20c5d455af99fb5417e19dfcb22c7476ca5ecdb8d468615cb5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646834904, "uuid": "f1605a43-ce36-46c2-8061-61437ad781ae", "comment": "Malware payload (SnakeKeylogger)", "value": "2586e547a8ab495141c3f3962d227d5e84603413", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646834904, "uuid": "ede348e2-2ef2-442a-aa6f-7875ecfc1740", "comment": "Malware payload (SnakeKeylogger)", "value": "cb4f2644d427a3c3bb12f66b53df318a77e35ac6a9d63ae2832b06483059850d3d5dd89a28ace7490ad1d1dbcbae8579", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646834904, "uuid": "4bca4a6b-7594-4d55-aabc-996c194fa780", "value": "T169458CD260E5849EFB7B4AF17F99F86C14A3FE6B1468104E11953B2711B330164ABF3A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646834904, "uuid": "f8783035-044f-4aba-8504-0705f944c465", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646834904, "uuid": "62e16547-c58b-49d9-ac0a-fea1e1655c2c", "value": "24576:ED5kRQs49jrP9rYIDxSbQE5pdYmqIIPrkn:ED5kR29H1ddudcIIPrk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646834904, "uuid": "f2a3634c-28c5-4359-9c3b-3464f20f6fbd", "value": 1277440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646834904, "uuid": "965dcb54-2287-4eed-bcf1-781eae2eda33", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646834904, "uuid": "307acc45-daaf-4616-a922-288cb9d4a026", "value": "\u00f6deme detaylar\u0131.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43a0d051-9fc4-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1646842583, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646842583, "uuid": "3f0b6115-78aa-427b-b1bb-76a68f171634", "comment": "Malware payload (Mirai)", "value": "0a38119fa4053bb7965404c62441030b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646842583, "uuid": "ea9a62ac-d287-427f-806f-96352db238d7", "comment": "Malware payload (Mirai)", "value": "0f5ce35bed061e59601be5832421ce5a72c77cedc081e6d6c57e7aaa8aab202d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646842583, "uuid": "3d140009-56a9-4cef-a669-75fce028becc", "comment": "Malware payload (Mirai)", "value": "9bce19b0b815ceccd078699985a7d1d21c77344d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646842583, "uuid": "977b71d7-0fad-467c-b26e-e995ae1ca18a", "comment": "Malware payload (Mirai)", "value": "3a8e6e6bc817c876c34d98a83d40cb560944312eea73d9e1d48eaec6421b627f3d47bd5663803f658529f84ccd9e40fd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646842583, "uuid": "e31f10b4-f7b3-47e2-85a1-1a6eddad9334", "value": "T147435DD6B401DE7CF94BEB7A80224A09FA35725154A30F27B267FD93AD720964C2BD07", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646842583, "uuid": "ffe356ce-2eb8-4992-a36d-777d6a576a25", "value": "1536:3tCdFUWy+s2OEpPru8qSLghCLXMpCkJnqSgDVHbEl089:qsjEpju83LgcLcpLVWHbKf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646842583, "uuid": "8e3ce917-75bb-4e68-865f-ddd94402bbce", "value": 59728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646842583, "uuid": "99484748-6433-4593-8812-1503a5a5abbe", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646842583, "uuid": "d30a7ddd-d7a3-4386-9abd-0a9a106ddc0e", "value": "0a38119fa4053bb7965404c62441030b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52e1e860-9f8f-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1646819846, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646819846, "uuid": "19d2dd75-ce62-4557-8293-ed3f80808bef", "comment": "Malware payload (Formbook)", "value": "9ca672d6b1a9eae4a85d22234ec39cee", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646819846, "uuid": "77f9bc36-943e-4256-9fac-1f5265adcd3d", "comment": "Malware payload (Formbook)", "value": "0f85d611cba06eb20d87da52fb1a7d2137353ac951f15fa153a0167965d7ae9d", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646819846, "uuid": "5ae80d19-8feb-4017-999c-17d1679514a0", "comment": "Malware payload (Formbook)", "value": "64208fdb68cd4ac417d297a40057ffe433b9661f", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646819846, "uuid": "54ce1408-ee43-4628-8945-da19973e271d", "comment": "Malware payload (Formbook)", "value": "86e533ca0f6cd2fe65f00be048fb53af56049d065087fabcfd12c5661a03fab24e945f41db6c04aa9aa72726cd6f3aa0", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646819846, "uuid": "7b0a3083-d777-4c9b-bd0b-385f4dceaf91", "value": "T1A464230BBC0E9F5C2E5E5F466118C36F8ABA545E4C858A6F84C9E347CDA14E0FE086F1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646819846, "uuid": "a15c8428-8557-4e6a-83ec-45f916b453b1", "value": "6144:n2UEAzs/GfzfTlhtSsA+jifUvm0REf4e9MqFyYBldzh+so2Y1:Z3QofHcsMw5REfxpF9dW2i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646819846, "uuid": "869a4a4c-656c-4470-84d8-3b982546910e", "value": 330211, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646819846, "uuid": "b8e741c3-8b15-45e2-a4ee-96efa3faf625", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646819846, "uuid": "16d2bbf2-56c9-4058-bbab-ed8239ac114e", "value": "SOA_OUTSTANDING DUE #FEB & JAN Updated LIST.r00", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c293371-9fb2-11ec-9275-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1646834920, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646834920, "uuid": "891e2038-ddd4-4e77-92aa-469c6d2ef522", "comment": "Malware payload (SnakeKeylogger)", "value": "2e2d09a2cceb225b81cc47a7af0fa03d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646834920, "uuid": "64329c4a-ac41-465f-b2b6-69fb123b0ed3", "comment": "Malware payload (SnakeKeylogger)", "value": "0fe6cda85c2f35d36baee4210b12c8b062361f092d010f457ac4434e7c5e594a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646834920, "uuid": "016536cc-5063-4c14-9d7c-1cebb0b64328", "comment": "Malware payload (SnakeKeylogger)", "value": "7f088085f051caf49dde5fb2868f0e08842a47d7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646834920, "uuid": "50f45ea6-7fcb-4c4c-80df-b1eaada643d1", "comment": "Malware payload (SnakeKeylogger)", "value": "16776e7023c793909e8e79470032c930338b0f26b6af4dcb5e85b06c4cb3326e7233fe4ecbfa4c65e983c7a5c3ff93a6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646834920, "uuid": "f0cf4aca-a426-4dc6-9c02-5e808624e1f6", "value": "T169F4949C312071DFC56BE5758AA85E68EF903C7B831B510B902331AD9A3F997DF244B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646834920, "uuid": "88765a72-9199-47a9-b657-81a1a6441b5c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646834920, "uuid": "1bab1e93-f890-4a1f-8d76-19c737d5b5c1", "value": "12288:yrRc+M/I2wwi+VHkP3FQrxzNpe6ANs5c3zyVNnfBmCWTmFbvdK4vVjnjkuNaDibW:yO+M/LuiE9QrxFUdrcGWaQ1JKzDDDDDh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646834920, "uuid": "cb72016d-475c-4406-a7d7-cbb08d0ba702", "value": 781824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646834920, "uuid": "c5b989d4-db40-4a22-88ca-3d7e5bff7dfb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646834920, "uuid": "55fb9314-9bba-47fe-afec-e16d80eebd05", "value": "E-dekont.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2236438-9f82-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646814395, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646814395, "uuid": "ce497c68-c043-46bf-ab54-ab54f1979764", "comment": "Malware payload", "value": "dc8638c8cf6b417c9910f62aa69c5ecc", "object_relation": "md5", "Tag": [ { "name": "Fake Chrome Update", "colour": "#6812FA", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646814395, "uuid": "05f87495-9f01-4b83-a9c4-e72c011d34aa", "comment": "Malware payload", "value": "101698a9e54bc871b41ec1220158f4ccda7a53ab14b2d6ef5970fe8a9583854a", "object_relation": "sha256", "Tag": [ { "name": "Fake Chrome Update", "colour": "#6812FA", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646814395, "uuid": "55f7ab05-6d20-49a2-b442-340712778af2", "comment": "Malware payload", "value": "42fc8f8bae5f96ed6a8546ff8f01cf227a3a40c9", "object_relation": "sha1", "Tag": [ { "name": "Fake Chrome Update", "colour": "#6812FA", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646814395, "uuid": "8413aa67-d4af-4de6-b815-d530d652b6dd", "comment": "Malware payload", "value": "a58ed41f1777b1c840ff1dcc6fce661b65615fe163ea62c635568b64a38c13e37eda203e47c99c01fcd1c7c4e9143f3a", "object_relation": "sha3-384", "Tag": [ { "name": "Fake Chrome Update", "colour": "#6812FA", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646814395, "uuid": "edd00173-7253-4d15-b220-64930cca387d", "value": "T13831EB5A32AD698D9EDB33868E3E1A4CCE5EE971F2E1E1B8F84591A05CE1408274391D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646814395, "uuid": "a4bb3083-edb9-44f0-91d5-fe9ff47a15cd", "value": "24:1rPCsiKXpoJChiKPPP+AWTpjy3pzE4LBqf/e4Lr/+dQf0JWYI1eyDiEPgvtFDNPg:1GHVsWEq6dQf0JWB1fDi51hG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646814395, "uuid": "68536083-ceb3-4b6d-b3fa-629bd5486b28", "value": 1555, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646814395, "uuid": "a431f676-8fe0-4b3f-9205-626230f59b24", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646814395, "uuid": "3928568e-b1ad-44b3-945e-d2bf2a5cee24", "value": "Chrome.Update.9f19ab.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f1cc2e5-9f92-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1646821262, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646821262, "uuid": "080a783e-a61d-4590-becc-87ef0f204887", "comment": "Malware payload (AgentTesla)", "value": "11799e9cf07cc435ef1a7ea9b6db24db", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646821262, "uuid": "f77271cb-a577-482a-99c9-b1cf5d8c8172", "comment": "Malware payload (AgentTesla)", "value": "105783469188956550d32a188ebc09e81335c78640a8ba2704feae48b827b444", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646821262, "uuid": "381c7156-8a14-4685-ac6f-04db16ecabe6", "comment": "Malware payload (AgentTesla)", "value": "63753c8717a68ffa8d08fdc6db2fc91e2e8a6a1a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646821262, "uuid": "09faed34-0f18-43e2-ad18-a8cf816c7d51", "comment": "Malware payload (AgentTesla)", "value": "c787795403f539ffa5a9fe951c671a4db9eec4697efc38ea3702c1e3851a52616d1450d3b615f2177a570d41a2f1491f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646821262, "uuid": "30d1cb02-a4c3-4387-951d-dd08a5e0f1ce", "value": "T1A2B423A97EF20A6BD299711429ECA1420DC88F36C1D76C7D5B70EF4906D1E38AC135EE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646821262, "uuid": "1408983c-4dbc-4786-ae82-64f910df5c50", "value": "12288:L6MI1fltV3Q682iMqG/iu6quUixA8fvFjjD7Xm1Q:LLIftV1817qoxA0Fr721Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646821262, "uuid": "2ee49c51-a7e4-4a2f-90bb-41c1124a7c4a", "value": 514526, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646821262, "uuid": "a0be9d15-6fbe-498d-bbda-24ef5c3cbe56", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646821262, "uuid": "04a2b37a-448a-423f-85a2-0a9f3c52786d", "value": "Bank Slip.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "524076f7-9fed-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646860217, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646860217, "uuid": "722fde4a-4065-4c77-92bb-b816d9015f57", "comment": "Malware payload (Heodo)", "value": "024725c2a82c1f3a1c568e7009beaaf2", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646860217, "uuid": "492b5e85-d7a0-40e6-8a62-c2fc3b3085af", "comment": "Malware payload (Heodo)", "value": "10754f5550f110e9936123c6c7dfeeec2ab081cf67ddfd0b0ccc1beaf8dfb9ca", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646860217, "uuid": "aebe3b5f-b212-434a-91a0-b841c788be9d", "comment": "Malware payload (Heodo)", "value": "e1b5c43b6ed7ecb5e5a03c7bb6f668e380746ca1", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646860217, "uuid": "fe4cf56e-13a8-4057-b6af-96c4eb9d4a13", "comment": "Malware payload (Heodo)", "value": "43d23e3747df2d2ede2e6dce74843ee7f230d9f869748902b6e715211d2eb4e1bcd901dc8d7ca60ee3e01b7b824651fc", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646860217, "uuid": "ab8e0a63-a49a-47fd-9e48-74540a53a5d2", "value": "T1F5D41A30BD5BF0F8C48A1BF46A05CA59620B7EA05625B0A372EE774D6F321334D39796", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646860217, "uuid": "fdb3cfc5-11ce-4eea-a831-6973d3e73198", "value": "b193e4975b360aaa9ff34a6f93823ae8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646860217, "uuid": "3b8aba95-021f-49f6-8610-e01fbe040c67", "value": "12288:ZxpNJJJ2NHPoczJCOtIhxf3foRXIa5EPwvA:Zx2gczJCFf3fnaFvA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646860217, "uuid": "c6f00ebb-3a62-4481-a256-1f8402d548b6", "value": 618496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646860217, "uuid": "f69f890c-c1ec-4d2c-b9fa-beba6122d00f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646860217, "uuid": "c8696519-a892-423b-a7a2-de8e2714dd1d", "value": "sokoban.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9eaaac6d-9f86-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646816107, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646816107, "uuid": "d8a9d41e-ec0c-4ec7-bf0a-eda8d3cdb06f", "comment": "Malware payload", "value": "8fe6f25fc7e8c0caab2fdca8b9a3be89", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RURansom", "colour": "#71CD12", "exportable": true, "hide_tag": false }, { "name": "Wiper", "colour": "#614E92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646816107, "uuid": "69c9ccdb-9287-4ad9-a64a-7b990791bd1d", "comment": "Malware payload", "value": "107da216ad99b7c0171745fe7f826e51b27b1812d435b55c3ddb801e23137d8f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RURansom", "colour": "#71CD12", "exportable": true, "hide_tag": false }, { "name": "Wiper", "colour": "#614E92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646816107, "uuid": "2b409518-f0a6-45f2-999d-06c8d525d890", "comment": "Malware payload", "value": "a30bf5d046b6255fa2c4b029abbcf734824a7f15", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RURansom", "colour": "#71CD12", "exportable": true, "hide_tag": false }, { "name": "Wiper", "colour": "#614E92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646816107, "uuid": "a0924d43-166b-489a-9241-c55579b65822", "comment": "Malware payload", "value": "d3426432b9832d53e2f09ac0e728c0b3d5b6f9a37ee8feb3bf5407be25978c8eada16fc5740a99781eb69c8951b0958b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RURansom", "colour": "#71CD12", "exportable": true, "hide_tag": false }, { "name": "Wiper", "colour": "#614E92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646816107, "uuid": "be63dcd0-c677-4765-b7d3-3e2827a955a9", "value": "T12C54238611A88424FF7EFD7C08E26ACE1076E30BC40BAF5A9D031D29973B3579672536", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646816107, "uuid": "3e993abe-18f1-4452-b6ce-e1f62aca40b0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646816107, "uuid": "160aa9ae-8cdb-4ae6-84bc-b4e4d2a024cf", "value": "6144:jxvRZVLlfh7rZthO+JjkuHEEAt/wz/60baxHU:7ZdfrXg+JwuKt/S/605", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646816107, "uuid": "b498915a-387e-4c24-ab9a-0e33d89e51a8", "value": 299520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646816107, "uuid": "96bb94e7-1486-4bdd-adca-d2c4a33f7a43", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646816107, "uuid": "d267f335-cd2b-42be-809b-72d9332f0e4d", "value": "107da216ad99b7c0171745fe7f826e51b27b1812d435b55c3ddb801e23137d8f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec04cb76-9fb2-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1646835135, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646835135, "uuid": "d7935b76-1286-40c7-802d-186c2b6f1126", "comment": "Malware payload (AgentTesla)", "value": "3256fb611dfbfee6b7e18199b3a818cd", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646835135, "uuid": "0bebc3d9-80aa-4dfa-af85-0f709574334a", "comment": "Malware payload (AgentTesla)", "value": "10a0ecc8af1839ef0f6663466486c51402b9a0c092eed0757c3078684cd34d9d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646835135, "uuid": "b4fb3310-dffb-48e1-a723-d1b0004f8623", "comment": "Malware payload (AgentTesla)", "value": "105e1923a682f6d34b0200473ec9a0302562e860", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646835135, "uuid": "eac6bea0-af93-4e31-94eb-c7551f1a9359", "comment": "Malware payload (AgentTesla)", "value": "b2defe919f27f673446198ebee466a04643b7a226fe62dea287ab9c12359167300bf15a1266948306785d3183f9e98d7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646835135, "uuid": "0f049111-f7c7-4101-a4d6-538b37534e89", "value": "T1CEE423A02D404AA58EB23F7AB34D9F68BD70E48B5C5762F5E0187354587323AEE1F44B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646835135, "uuid": "0c212465-f010-4b13-9aeb-4b036a5f79dd", "value": "12288:JCV/92I5mk7Snf9b6zeCXvSreZpkXdDY0h8Ig5hCIfe7lSNUN:IV/9vD7Snf9bcFseZKXdDY0h8Ig5hCay", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646835135, "uuid": "a7d331c3-13e8-4865-82b0-ee90772e417d", "value": 659874, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646835135, "uuid": "8dfc2075-ce15-469c-b3a9-fcac2094de83", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646835135, "uuid": "9d5be5a5-beca-4f32-ac01-f29175a66dce", "value": "CUSTOM DECLARATION.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a945ddf6-9f7e-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646812689, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646812689, "uuid": "d972b566-82c6-4d13-92cd-17db5c1f3a60", "comment": "Malware payload", "value": "8c0b732a5cb8a36a2f1a0ebd86cb2afa", "object_relation": "md5", "Tag": [ { "name": "fake chrom update", "colour": "#EC54F4", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646812689, "uuid": "15a0fb6e-8ea2-4784-ab82-59a34a737ba4", "comment": "Malware payload", "value": "10d646027680c557d15d1bedc42b38938453b66ef843f3ac2cd8323db4941a85", "object_relation": "sha256", "Tag": [ { "name": "fake chrom update", "colour": "#EC54F4", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646812689, "uuid": "04b8ab50-0eda-40b0-bdb0-28a63203adc5", "comment": "Malware payload", "value": "066214ce0e2002c245acf6a2a66bd036a3df9fd0", "object_relation": "sha1", "Tag": [ { "name": "fake chrom update", "colour": "#EC54F4", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646812689, "uuid": "a545d747-87c4-453d-9593-bd92f9e9b100", "comment": "Malware payload", "value": "f910ff895b4675b9bde7fc449e464c481e90fec32795da2ea3f582e28ed5b568ef518ba94591307928d837f11d26f1a2", "object_relation": "sha3-384", "Tag": [ { "name": "fake chrom update", "colour": "#EC54F4", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646812689, "uuid": "1b84663d-5e91-40e6-a7ba-fc26aea63c99", "value": "T13A515406718A7488F7E637A40D7F689AFA1BCC21C408A56B79D8E5886FD0D2C4394E7D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646812689, "uuid": "a3f11d8a-4302-4521-8741-fb8d4574fa0b", "value": "48:YiSyrmQ3yWu6OacgQYSrBo/iyuRPf+lhYlYa23m5GfDU5v0JW1n1Vi5AyiIuLiQf:Y20WdGgEBQuRPf+g2qeDDYpi5ArIwinY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646812689, "uuid": "9635d0b1-031f-4ee0-93ff-4f53fc81b1eb", "value": 2641, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646812689, "uuid": "fe07c2c5-2d37-4ea8-a16e-aaf43fc52b9d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646812689, "uuid": "bc6db63a-fdb1-4945-8835-66821aa2389e", "value": "Chrome.Update.28fc8e.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47b74a4a-9f84-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646815102, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646815102, "uuid": "de33fe5c-c3a2-457e-9d7d-364bdbdbe0b0", "comment": "Malware payload", "value": "944268ba5bba4951d69df52dfccfda82", "object_relation": "md5", "Tag": [ { "name": "NimbleMamba", "colour": "#B0B1E3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646815102, "uuid": "64b30fb1-8fe8-41a2-91fb-b6478e9d4bef", "comment": "Malware payload", "value": "10e2734e02545018ebd20854a62e338460c4dc66e6558cfdb424f8028b75ada9", "object_relation": "sha256", "Tag": [ { "name": "NimbleMamba", "colour": "#B0B1E3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646815102, "uuid": "77b9253b-f2ef-4c55-a828-c82799f13a50", "comment": "Malware payload", "value": "2f29ae31c2dcaabce33266ff4e1d3bff69d9b56e", "object_relation": "sha1", "Tag": [ { "name": "NimbleMamba", "colour": "#B0B1E3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646815102, "uuid": "5ba50a9c-3a34-49cf-9b03-cd5095ec02c4", "comment": "Malware payload", "value": "98bb558a7bfe2bc02ad9417f0262e5280c6a4679bc7ad086785920e76c358287121ad2fb31b93b9b2dacff092ff3fa8d", "object_relation": "sha3-384", "Tag": [ { "name": "NimbleMamba", "colour": "#B0B1E3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646815102, "uuid": "20d42021-49cd-4f51-9393-b70e46ad5ef7", "value": "T10BD423B2670AA9CBB57A117000A7B72750379EDB343CC4F8C900F9CF8B577A9A658D52", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646815102, "uuid": "8773162a-0cf9-4d2a-828d-0aff7b7c5580", "value": "12288:mZC8vdeEkSvJLDbvjph6qO56xXeTwlyspcLJjUdKxpJ3TXLu:m9vdeEkSxX6qOExXeyyspctI4B3u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646815102, "uuid": "a0ae0bef-e8c3-403b-af6a-fe1df293d503", "value": 646450, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646815102, "uuid": "00de038c-e17a-4bfd-956c-09b816268ea1", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646815102, "uuid": "5d79a24c-6f82-4729-b552-b5de61035852", "value": "0f4f2f1c-c769-4bb6-7bf3-dab2853c87f8.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9bea84c-9fcc-11ec-9275-42010a9c0029", "comment": "Malware payload (Quakbot)", "timestamp": 1646846244, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646846244, "uuid": "6045c280-7011-453d-b9c9-383b0ec6f40e", "comment": "Malware payload (Quakbot)", "value": "94b352fd8fc421b3250cb6f884c30d06", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama164", "colour": "#6C68A0", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646846244, "uuid": "8b7f3549-8c22-4634-bf93-364fd70934df", "comment": "Malware payload (Quakbot)", "value": "11e04e06de6279a383da18618f0f174e03e4e06b28555093188f331d1c2fd597", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama164", "colour": "#6C68A0", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646846244, "uuid": "ab48f6f1-8475-466e-9137-9224e45b2daf", "comment": "Malware payload (Quakbot)", "value": "e197a35a842b0ff83cb9c5f5ec3df2124572b1a3", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama164", "colour": "#6C68A0", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646846244, "uuid": "be05d64e-e559-4937-bef8-71aa633c339f", "comment": "Malware payload (Quakbot)", "value": "e51723a478c2bb54f896ad77c8d2df25a418fee23c8f2a07bd4c55d052af3eff4149ddb45786bd79a1a6e64bc7152da8", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama164", "colour": "#6C68A0", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646846244, "uuid": "3d6ad06b-b7d3-46fd-bd4d-bb576a756f6f", "value": "T1C3657E23F2C1887AD4761A3C9D1B739998BA79112D28F4C77AD44E8C1F37A433666393", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646846244, "uuid": "330071a8-ac85-4592-8f62-81c3516477af", "value": "cf78a88c4b0403a976a85038ec51a351", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646846244, "uuid": "ef4a702e-310a-4320-8429-d21b71eb6ded", "value": "24576:LP2GXxd5hyXOZk/R8SoMbEYN54UUrW/tRJfJsOIU2SAHl4XoWSIgX4T:Lu8jI6kcYN9RsiKKgX4T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646846244, "uuid": "7c5ed9de-98f7-4f7d-bc50-3eedc54cc703", "value": 1502720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646846244, "uuid": "401e5469-0aa2-462d-8dcd-8695724f2b3c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646846244, "uuid": "48fc6262-d9b0-423d-aeb2-6e663c569c98", "value": "8923266.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e45d5c5c-9f50-11ec-9275-42010a9c0029", "comment": "Malware payload (RemcosRAT)", "timestamp": 1646793031, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646793031, "uuid": "03123bff-881e-46e9-9bcc-f6488777bc92", "comment": "Malware payload (RemcosRAT)", "value": "952d729b861ec94505492eebaf04aa10", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646793031, "uuid": "cdc8f641-9d6b-4272-a601-1c6b207f9693", "comment": "Malware payload (RemcosRAT)", "value": "1201a0c89e08bb6bad16c0a265ed660dd8473a16bf74980f372ed0a49190c39f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646793031, "uuid": "e9b85603-d644-4ea5-9aa1-c901c74539df", "comment": "Malware payload (RemcosRAT)", "value": "d51686dbfea237426d195d30a17a79cb44ad5902", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646793031, "uuid": "96d8a125-4641-432c-afda-fed84c514f8d", "comment": "Malware payload (RemcosRAT)", "value": "57043e879fb88ef3f13f8ded878b985bd59d7a8b195f747ce50bd0309b25f0b79b7d19676f3a495dac6838e9c50ea247", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646793031, "uuid": "2ab5a245-104d-4bea-be4f-20a750ab4abd", "value": "T110559DE219EA081DE376BB722FD4F88E996AED63351E60DB19713B724133D808D21735", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646793031, "uuid": "d468e2bf-f9ed-48f5-adbc-d924d5ed6cf3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646793031, "uuid": "96ebf4eb-baef-4db5-bf53-fef618db875e", "value": "24576:QD5k9eAvyViXpArqO6PGbphR4hDi6dVJGgQL1aQaWvMi6Yf5mrEYDnWIn:QD5kQQvpA96PKpkhe6TtS1V7v7F5mrEk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646793031, "uuid": "8691347a-7012-48a7-a5e5-63542330ab51", "value": 1344688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646793031, "uuid": "18cd5430-648b-4933-b839-ecffd4d62f6f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646793031, "uuid": "7750eb69-687a-4649-9454-52762f9b7370", "value": "complete order march xls.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a5dbb40-9f9d-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1646825979, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646825979, "uuid": "9a235b16-2609-4cbe-977c-ab6a603b0f64", "comment": "Malware payload (AgentTesla)", "value": "af1d829dc52e02bae545d3102c96b2e9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646825979, "uuid": "937ae2e7-6c45-470b-ae36-2d0e38c225ba", "comment": "Malware payload (AgentTesla)", "value": "131f5c8633fb8bc24431ee7f8b99aa522e2f4bf6eaf4605e9234403144d5ad83", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646825979, "uuid": "2b1e232f-256a-48be-b40c-37aa87a54ad4", "comment": "Malware payload (AgentTesla)", "value": "51b00c15bf86e2db11a615eb0c2bd4412f0065d0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646825979, "uuid": "d531d75b-e446-4648-b453-2c0e5f132695", "comment": "Malware payload (AgentTesla)", "value": "68692d1709718466021b0507b73177a34890fa0792c15ae21df3ff00520ec53c55aba07b365b083b4801ff2880056a07", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646825979, "uuid": "42f39bd1-7dae-4f7f-9f5a-68b13a185bcb", "value": "T178826C1933D5C777E4FA8F3256E70A50A674E27499374B0EE88A123FCE137090A66B71", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646825979, "uuid": "a6fe4f7e-c4a4-4520-aed8-8feafd9ba2bf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646825979, "uuid": "2aee35c0-7aa7-4a5f-bcb0-0041aa78ea46", "value": "192:uONLHsPbnY6tgLItjZ1qm3gHBNMGBUKdepk0KVOyghWsxu3zhxGaBZOvKADb:fVsPb3tgLItdLSUaepk0OOyd3zhzYp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646825979, "uuid": "fcdcde2d-74cd-4385-a16b-d5828fb3031d", "value": 18944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646825979, "uuid": "d5f59df7-50fc-44d7-b78b-451a8838f6fc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646825979, "uuid": "573c24b4-c104-46ba-b2ec-55a8de50ed99", "value": "ORDEN_DE.EXE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5acf4382-9fec-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646859802, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646859802, "uuid": "1b2aa872-7a41-4c95-9634-246ab913be4a", "comment": "Malware payload (Heodo)", "value": "28c6d0d77d8647351639b7266b173347", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646859802, "uuid": "a4893baf-278d-4315-b4ea-cef69eb4e91a", "comment": "Malware payload (Heodo)", "value": "13869ef2592003b9c1ce6c916fca049d75afcb3ebfac6f67cc606117f3291387", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646859802, "uuid": "c1c4498c-ee97-4156-aff5-3ceb8eee475d", "comment": "Malware payload (Heodo)", "value": "4eb6964464a795eee4e99e15a9d275d86c757863", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646859802, "uuid": "76271337-1dc5-4c47-9ac0-9e98dfe2a522", "comment": "Malware payload (Heodo)", "value": "9553a5359365bb4123913808170e399e4a59b92841d6a999a4b60fbd4a83b7ec74d80f03a20be225e17dba125f81bb58", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646859802, "uuid": "a23262a5-8e3a-4910-822c-e1fe1b23b0c6", "value": "T1EA257C107E8A817EC71B85B30836676D6FFEAB204B6CA1CB478175ED2D316C29B36705", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646859802, "uuid": "320869e7-3357-46e9-962f-0e372aee427f", "value": "087c9809507dfca4c3283e6c7539e91c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646859802, "uuid": "6d6fc3df-28bd-4cc0-9a10-573dcb08d5c1", "value": "12288:cR5SOyRHiA6m0OcEl6zt6JtcS1j2xKkr:cR5SOrKl6zEtcK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646859802, "uuid": "cf5bd1ec-1141-44f1-9fa2-cc1d6a6556aa", "value": 1040384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646859802, "uuid": "0308d776-42ad-4d6c-831e-d25a4eff8b86", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646859802, "uuid": "4b0457f5-92af-46d1-a17a-aa564154bdbb", "value": "28c6d0d77d8647351639b7266b173347", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21c7bdbc-9fc4-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1646842527, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646842527, "uuid": "49ba0a0d-a84d-4190-931c-5f13a6199a1c", "comment": "Malware payload (Mirai)", "value": "f8ddbf94ecded79cadd046a8a204202d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646842527, "uuid": "847f4bb9-5d1a-4585-bcfe-3eab84ffe290", "comment": "Malware payload (Mirai)", "value": "13f8812c9088bac147df52224525f48c504498ad899ce9c0b64b3ca79891655a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646842527, "uuid": "d27dc5d8-516f-41e2-859d-5e2153b121ba", "comment": "Malware payload (Mirai)", "value": "3fc321dad9abe7c2cedb01abf7c8b7f26f4c1d18", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646842527, "uuid": "c4b5c15f-7837-4546-8a38-ca33e11b2953", "comment": "Malware payload (Mirai)", "value": "d99ed44ac797f1f6aa282925313c3817f40ef5a239109640bce705a72299f18371f8d19b8f27515f5421b139b34d5264", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646842527, "uuid": "fc18ad94-7f3c-420e-bcd8-7949e881283b", "value": "T1C0B2C0F12A9D21B0F2F0A937F5B84985779A1670C0AE736133040AFDFF954A662F91C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646842527, "uuid": "6b1b6303-3c3a-4305-b3a4-b623ac805040", "value": "768:SwwgSUT279k8X3MvHKMdcWvQTE5LlptUA3U5:/HOWW3MvH3c4Bptq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646842527, "uuid": "cd64f02f-ab64-4155-b9d1-3a4299b305ba", "value": 24812, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646842527, "uuid": "803acd9f-6ac8-481f-8f14-18ed84feb168", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646842527, "uuid": "ba97c676-b8f8-4361-99ff-1385c603c4c8", "value": "f8ddbf94ecded79cadd046a8a204202d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9f1ca64-9fb6-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1646836876, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646836876, "uuid": "ddd887a6-782c-4ceb-a278-17e5c9f37f03", "comment": "Malware payload (Formbook)", "value": "d5f997ad79d8a4ab1b30f482a79b53b3", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646836876, "uuid": "76c44366-390a-4c26-8fd9-44d2de7391fc", "comment": "Malware payload (Formbook)", "value": "144e6ea7d16c2ef6976651641b4e6142c659deb957f44934e2c849f0470c915d", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646836876, "uuid": "2c5bf944-e662-46c9-bcd0-aaa5f9cf20e2", "comment": "Malware payload (Formbook)", "value": "321ddbb6f54a2552893e29d8e64d81319963afcf", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646836876, "uuid": "d162c832-73d7-44d3-8ec5-389ede351e82", "comment": "Malware payload (Formbook)", "value": "8d087be06b465dbfdc5982f6478893210ab2336641fb563a0e8f0e11c4003f5a33127beab088457401173cb223eed1f7", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646836876, "uuid": "11bbd3db-60bd-4365-8e58-3f378b490ed0", "value": "T1A414126236739401F876AEBE09354D2117949ED8BEF9DE573889700AB73FF10D532A50", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646836876, "uuid": "99fd7c37-0ee1-4598-9e90-3645135e4699", "value": "3072:YnPEukRQZq7H2BYbJiomCs0b31OBD4y77c3f1j0ua0m52WjPf2QWaTNg:hukWybkomXRBDLGVTmcWlNg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646836876, "uuid": "269a3fc1-c5b2-47b2-be52-9fc6842303f6", "value": 191128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646836876, "uuid": "350d8e27-9419-410a-8a58-49de2ab92aa8", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646836876, "uuid": "a4a2f7e3-baa3-4db7-ba69-a277ed9dfc1d", "value": "New Order.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68c51d9c-9fbc-11ec-9275-42010a9c0029", "comment": "Malware payload (Gozi)", "timestamp": 1646839210, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646839210, "uuid": "ce6d95d8-c3c9-405f-803d-b3a83f9a28a3", "comment": "Malware payload (Gozi)", "value": "e2f228a5567d952cb7af6c593509b701", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646839210, "uuid": "6fa094a6-b347-4d99-ba8a-f7c0c2ba788c", "comment": "Malware payload (Gozi)", "value": "14e041ad11be886018e643ed1cff9abe512e787bec794ab585e75f91e2da119e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646839210, "uuid": "93f545c7-b9b7-4ae8-9fed-4a827e856457", "comment": "Malware payload (Gozi)", "value": "7eea2166bfc6e2b1f99ccc2b43febc110d133c97", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646839210, "uuid": "315fd183-61cd-4fa2-832e-73d2d0610e9d", "comment": "Malware payload (Gozi)", "value": "0d3fcb6171cea0fd688c61203d75b8e2b16bcb3920cdf68c49623343cda9fa8524d8eff5466371c5012a19ffdd920215", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646839210, "uuid": "c0a9eaa3-22a9-42a2-a7e5-42e328882a9a", "value": "T1BD548D10BAA0D435F5F316F8597A9378A93E79A09B7490CF52D51AE917386E0FC3130B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646839210, "uuid": "8f90e48a-e478-4b89-bfd3-1e6dd2424485", "value": "2eebe0dba96971c51a6bd6aeb0592251", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646839210, "uuid": "985a6b1e-e72d-4cd4-b32f-6c9274621417", "value": "6144:LHKWhw6yLuGepvWoacFScIAHBRi+auJ8b36VjK2880G:jvwFjGvWNciAHXT/82Z7a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646839210, "uuid": "2ef6f7a2-76f3-46ad-bf21-f300e5e7d88a", "value": 297984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646839210, "uuid": "138ce208-c813-49b4-962d-4eed278b9c32", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646839210, "uuid": "2ba27c56-3b0d-437d-93d3-6c5b289599a6", "value": "e2f228a5567d952cb7af6c593509b701.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b31cbac-9f9d-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1646825873, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646825873, "uuid": "89359859-aa35-43ed-96c5-31275e5b6830", "comment": "Malware payload (AgentTesla)", "value": "ce55690f4b4c5d5804f8e3d7cc8c2e60", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646825873, "uuid": "ffd74d7a-a81c-428e-ae8d-4f47b93dab0c", "comment": "Malware payload (AgentTesla)", "value": "155ab816f3fd97025b4fa4c1c96b9ebe860bd3d4fea3cefdfac3b5eb4c6a096c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646825873, "uuid": "09ee2326-1d9d-4b23-9ed0-ea63a134dcf4", "comment": "Malware payload (AgentTesla)", "value": "998674bb9cc6f949e749e6460f365af9825b964a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646825873, "uuid": "4f189b91-9b48-4910-b289-76cd939dcae2", "comment": "Malware payload (AgentTesla)", "value": "e54e708f4a97aa1244f04329c44c2ee87e7f0ddbd5824b0c1f13d648f264ed4b71c405d81aec04886458057995c6ec65", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646825873, "uuid": "03de3260-c8c5-449f-a2d9-fa6c1aaf3474", "value": "T12435AEE229EF501DF377ABB12FD8F8CE986AE573151A30DB10521B768423A80DD61736", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646825873, "uuid": "522b91cc-e950-402c-bc8a-afd5ce38f060", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646825873, "uuid": "890dae31-6cae-4f94-ada6-cf125d4688ff", "value": "24576:6D5kq1HVcfLe3cdWQmRvL7IF/Cpf5JWvuS:6D5k2VcDbmN7wCd+h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646825873, "uuid": "ca3010ee-831e-4e21-bc20-aa10731f2b29", "value": 1119232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646825873, "uuid": "ea63df1d-b7e0-401c-8023-30b32f68b6e4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646825873, "uuid": "527f7a2d-bf18-4c9c-9d08-ebbac91f41d5", "value": "LB3371.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1740612-9fec-11ec-9275-42010a9c0029", "comment": "Malware payload (NanoCore)", "timestamp": 1646859921, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646859921, "uuid": "caf475e0-098d-4b79-8018-8a0f55b03e54", "comment": "Malware payload (NanoCore)", "value": "6f71eac3adf1ec8db2fe5f4da48b0097", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646859921, "uuid": "325d0b27-114d-4ded-b18c-f53433e5c027", "comment": "Malware payload (NanoCore)", "value": "15999071d1765a382619a065bec1359b787c8850b6382dcc7390db00485c11b1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646859921, "uuid": "cff91663-5ff9-4615-b1f8-c14acb55bb18", "comment": "Malware payload (NanoCore)", "value": "fe289953e78a110cc20a5c7e0225a62ff1d8cd74", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646859921, "uuid": "6b909ea8-6fc2-40e7-9b1f-c1e8dc344e5e", "comment": "Malware payload (NanoCore)", "value": "c5e8014de2b27e77bc816ca387f7c2e7f0f1f42c08d12c49d5c2788b3b55ab4c6d90b87d525d5b84ed56b75e3b1dee17", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646859921, "uuid": "00ce53a0-18d7-481a-97a3-b802483f8c3c", "value": "T1E314CF167BA84A2FE2CE86BD702242168778C2E79CC3F3DA1CD455B68F567E50A071D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646859921, "uuid": "967c4ea8-3ccf-448b-b77d-42ef2e15225d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646859921, "uuid": "d65974b5-7def-4775-8958-16d04b114c5d", "value": "3072:szEqV6B1jHa6dtJ10jgvzcgi+oG/j9iaMP2s/HI0hiT05t4Ziu8hBVv4TPcXQZq9:sLV6Bta6dtJmakIM5MGtMMnEcXs7hm3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646859921, "uuid": "87c2a8ab-e60b-4cad-9ac7-276ea18e149a", "value": 207872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646859921, "uuid": "84638d42-a1ad-4fb0-8401-af21e7587abc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646859921, "uuid": "6c1b8ceb-bf0f-4359-b804-04ee04c5b96b", "value": "15999nan.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3001d94-9fb2-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1646835093, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646835093, "uuid": "b8809db4-a19d-43ce-ba4b-5e2840faf63d", "comment": "Malware payload (Formbook)", "value": "eaeb65f40071904cbdc8d3d0e4b14796", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646835093, "uuid": "674d40e4-e2c1-4262-bf00-2375a8980057", "comment": "Malware payload (Formbook)", "value": "15c33b5b0c8476bae865460e62528c195feb03e8c5e3318128d417c31bf22ecc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646835093, "uuid": "4342d08e-97dc-4186-b307-e912dd365194", "comment": "Malware payload (Formbook)", "value": "b8b784ea2287b36004b7501d1289fbf75a29ac64", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646835093, "uuid": "d11f1102-8357-4d3e-be7d-f67d19b8701c", "comment": "Malware payload (Formbook)", "value": "c79b30142f7d62d9abaf7d8806f406bad4801d6d197dce43d876cbc5b11afae513deff82baa6f2319fd081182a03af0a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646835093, "uuid": "b5cceb5b-6079-47d3-b759-4181274d9ef1", "value": "T1DD6423DE7EF214A3D28B45722E75F3FAF2B1F9DA02A919475F30AE6A5C220470705760", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646835093, "uuid": "d502e9f3-c0f6-4fde-9773-10c4a4cea92f", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646835093, "uuid": "6781b62a-9e79-432c-bd34-7015c0211495", "value": "6144:rGi9bTDVI5tYSFDlOL5sai7/pnhD8d7cc1FCr/sCk34D/G:9+XnDlOL56JBMPu//5/G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646835093, "uuid": "3060412d-97e0-43db-9853-a712d3284eb4", "value": 317119, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646835093, "uuid": "9caa4e9a-39cd-4c52-b2af-e490acd0faca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646835093, "uuid": "d0f58d90-90b6-4300-aec6-eef8b24735f8", "value": "RFQ_Order25347_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb67dcb5-9fe3-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646856126, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646856126, "uuid": "632330c4-b93d-42a4-b3af-60b3eb3c5121", "comment": "Malware payload", "value": "511863894b5c6d1bb02af33d8932cf44", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646856126, "uuid": "ae885fb5-e3fb-4c65-9a15-b7553a5cd0ef", "comment": "Malware payload", "value": "1643e9d37fb065a78bc53d520c6058de1e397003323022dffe2e0a62cef260d1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646856126, "uuid": "da6400ae-2dd4-4ab9-b970-dc209d456e5a", "comment": "Malware payload", "value": "de20bbfe236f2501fb03a3600a5b0efbed3b6ff1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646856126, "uuid": "278091a5-7ae8-4ff5-923b-200bfe243fb9", "comment": "Malware payload", "value": "29e7a53a9800c65f769e88f7ac4160e05731d0ce919dfba0344e4031f35081f1e333d6b9ae6827b47f582f03207739d8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646856126, "uuid": "ea9c5ff1-8507-4b93-9da3-29beecc51096", "value": "T14E8533401FA45180F4E561728BEAF557EC76BE2C8D46940FE1ECD81572432A2E9E4ECE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646856126, "uuid": "ee34a35c-a7cf-4720-9c05-a4af1dce97a7", "value": "3d25132d07a4ec15142730334a95d3c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646856126, "uuid": "0a07e89f-8984-4615-a87f-5238166f04a8", "value": "49152:+4iYkywGcjdJgLf1Hy1j2+CYn7FSp1gH9:+47biRJ+f1r+CYpSsH9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646856126, "uuid": "ebfa8da2-b166-4930-869a-00397db254ab", "value": 1727120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646856126, "uuid": "832bbb34-dce1-4c01-8b74-8bc1bb919756", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646856126, "uuid": "1cbb3dfc-2539-4b1b-864b-fac4e669f081", "value": "511863894b5c6d1bb02af33d8932cf44", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90058a12-9fcc-11ec-9275-42010a9c0029", "comment": "Malware payload (Quakbot)", "timestamp": 1646846148, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646846148, "uuid": "cd3a00a3-611d-4d02-b77f-e6f20e1549c4", "comment": "Malware payload (Quakbot)", "value": "206f9da62930605b2cb72dcf86c9d3fa", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama164", "colour": "#6C68A0", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646846148, "uuid": "86525b76-e7fa-4f74-a28f-2b96cbb3b172", "comment": "Malware payload (Quakbot)", "value": "16a422f72038d58a972f54201b0c2d05b4ddf7a21831006e55e320c74db26aee", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama164", "colour": "#6C68A0", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646846148, "uuid": "f7faf6e9-74f9-4de8-8a09-5a76492cb47e", "comment": "Malware payload (Quakbot)", "value": "bd4568b64c5abff1936a844644f0c21446b20caa", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama164", "colour": "#6C68A0", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646846148, "uuid": "f0318f87-40f7-4c52-bd00-9d76ce3f36c8", "comment": "Malware payload (Quakbot)", "value": "61efc65a4b6550ccb89c89f4bf29225f96ec14dd313197ebe6f0c756094cf80d96c7ee49645694c5b72e2ec14b9a0985", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama164", "colour": "#6C68A0", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646846148, "uuid": "eb24e5d8-4f02-41b1-b8a4-89381fe557a3", "value": "T1B8657E23F2C1887AD4761A3C9D1B739998BA79112D28F4C77AD44E8C1F37A433666393", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646846148, "uuid": "80ff14c8-9452-4086-a919-f4b479538b43", "value": "cf78a88c4b0403a976a85038ec51a351", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646846148, "uuid": "04cdeea9-237b-44aa-b539-f2e49d62bdd0", "value": "24576:LP2GXxd5hyXOZk/R8SoMbEYN54UUrW/tRJfJ3OIU2SAHl4XoWSIgX4T:Lu8jI6kcYN9R3iKKgX4T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646846148, "uuid": "c90ccf26-8ded-4bc0-a60e-4a7ccd407778", "value": 1502720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646846148, "uuid": "d18da81f-d11c-4453-922c-54233622b9f4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646846148, "uuid": "f1a11a80-cbf1-422f-9335-c267470f8361", "value": "3772809.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "552c00c7-9fbc-11ec-9275-42010a9c0029", "comment": "Malware payload (Smoke Loader)", "timestamp": 1646839177, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646839177, "uuid": "22224dbe-ea17-47c9-87b4-fdf96c512984", "comment": "Malware payload (Smoke Loader)", "value": "e4d4f6ba8329a58768b6c30afdcd1e25", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646839177, "uuid": "5495d032-f2f5-4f9c-aa51-925482c9b96c", "comment": "Malware payload (Smoke Loader)", "value": "16e387601a084c5712d0f9fc8dc4a09a894521c95a20a7596b68fb6088682613", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646839177, "uuid": "5e489121-d09a-4d92-bdfd-3984e0ec6a3d", "comment": "Malware payload (Smoke Loader)", "value": "60ecc4e76e333422ff1fb387cfd24531c4ed9898", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646839177, "uuid": "4138e7a6-53d1-4a4c-bd3e-3f4fdfa8e4ae", "comment": "Malware payload (Smoke Loader)", "value": "206b32c1b784f2902ddd6c7c16bf6acb4d01788c75a674b159cba6421747f9e643f846e933da3ecd89af9cb4696c96d5", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646839177, "uuid": "7d78c513-c238-4d32-912d-527cb47aa3a4", "value": "T1D1749E00ABA0C035F5F712FC957A9368BA2E7BA19B7450CB52D42AED57346E0EC3071B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646839177, "uuid": "a8451262-2874-4222-bd16-856918ef1e5a", "value": "ee7c4bb4ec9bce22f4acc67576d77beb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646839177, "uuid": "0040cc62-b4f9-4098-b919-8f21e6319c4d", "value": "6144:wMTNrC182r64iq9wH0tCFpsJBZebBZowRYn:fhC18+jiq6UKsJb+BM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646839177, "uuid": "bdbfe125-fdf7-4b3e-a4ae-59780cea461e", "value": 365568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646839177, "uuid": "9f16fb2a-5060-4ffc-944e-1d7c5e6a6d1d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646839177, "uuid": "dd3b2ed3-7fb5-44cf-adb7-3135a4deb267", "value": "e4d4f6ba8329a58768b6c30afdcd1e25.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9e7bfc4-9fe3-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646856150, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646856150, "uuid": "f252298d-dbd1-4ad8-a397-f786004343b4", "comment": "Malware payload (Heodo)", "value": "cce4be3902950c543cf5afd8bd1c5eb3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646856150, "uuid": "841f08b1-6637-4061-8418-f584994aa40c", "comment": "Malware payload (Heodo)", "value": "175222fa28f3493556e1d797a7a4e3d607159d13e421504b3982051222975b71", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646856150, "uuid": "27485a65-dbce-4778-82a0-658cdb5f5cca", "comment": "Malware payload (Heodo)", "value": "07bfe33c722b14adbe10807f56c39d1dee404ab7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646856150, "uuid": "4c5a78bc-e6a2-40f8-acc6-6a75443eebd9", "comment": "Malware payload (Heodo)", "value": "0f7b31e1561ebe5803de20e66f61925b77321923ee77d1f78bf18259a61edd45ed51a752174a890d89e4b0aa10a626b7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646856150, "uuid": "7a340908-f434-4852-afb4-7e8ed8bcad55", "value": "T11A257C107E8A817EC71B85B30836676D6FFEAB204B6CA1CB478175ED2D316C29B36705", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646856150, "uuid": "d8fdb3d2-eef1-4536-ba57-991217fefb91", "value": "087c9809507dfca4c3283e6c7539e91c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646856150, "uuid": "57d7c1cf-7678-427c-b964-4ae7bcbab7de", "value": "12288:cR5SOyRHiA6m0OcElfzt6JtcS1j2xKkr:cR5SOrKlfzEtcK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646856150, "uuid": "47061eb7-a2d8-40ca-9190-6e578bb7f974", "value": 1040384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646856150, "uuid": "10bb43e2-013b-46e6-b1eb-01cf2975f7b3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646856150, "uuid": "4bdf949b-7933-4f24-b5da-a36c7475ad49", "value": "cce4be3902950c543cf5afd8bd1c5eb3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58913889-9f7b-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1646811265, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646811265, "uuid": "14c6ae4b-1955-4667-881e-380889fae72d", "comment": "Malware payload (Formbook)", "value": "d835fc8635db136a5c620aa417caf956", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646811265, "uuid": "7dcacf1a-9b34-4a37-b11c-3cbd6dbeaf49", "comment": "Malware payload (Formbook)", "value": "1777cad58e9516ffbeb10b73f8b751d8689a71712266f223e2281a425ed09551", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646811265, "uuid": "0c21d7bd-b4da-445e-a0b5-8360664f95c1", "comment": "Malware payload (Formbook)", "value": "35ef698bfcab1c0763d469ff3b70cb6ac21d134d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646811265, "uuid": "c80e3147-47ac-4f99-a48e-15872707238b", "comment": "Malware payload (Formbook)", "value": "754bbc9836bd14f57206d02ef02995d6b1a76b2126ba75aaaa95ff75c79404bf0b8575994f08bc6d1f8e2071893c611d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646811265, "uuid": "a33ee6bb-2fa4-477e-b3b9-eb6cc9d90125", "value": "T164059CED77905077C1222A748D1BA3B8A42DFD103F2554436AE8BF0E7E349953A3D2A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646811265, "uuid": "731671e0-d304-49a7-9a3c-eca0a48fa3ec", "value": "9a2305e23c811e08425371fd3caa41ef", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646811265, "uuid": "b4a69fcc-0d50-40f3-b227-fc6d13b4bc2d", "value": "12288:cPsyMBzW+hNm5/WWZfeApLrY6xVct+LeIzl/9RIlRfk:qsxl05/WQeApwkVykhg7f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646811265, "uuid": "0fdf0b25-736d-4d15-b949-4e1636c18996", "value": 837120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646811265, "uuid": "58f71b7a-6b0c-4bab-bbeb-5a483ec680b4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646811265, "uuid": "05f63a72-f1a9-4638-bc18-59222f23054a", "value": "JAN & FEB SOA_EPDA Overdue Statement for reconcilation.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2860697-9fcf-11ec-9275-42010a9c0029", "comment": "Malware payload (Tsunami)", "timestamp": 1646847601, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646847601, "uuid": "b5bf4b81-21eb-4aae-98cd-422bbb74dbf5", "comment": "Malware payload (Tsunami)", "value": "9a3ec09ab3ac132d5089e293e22078ff", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "log4j", "colour": "#B82EEC", "exportable": true, "hide_tag": false }, { "name": "Tsunami", "colour": "#BE6B05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646847601, "uuid": "f9519ce5-f975-4191-8cbb-448d94faca84", "comment": "Malware payload (Tsunami)", "value": "177de2e81e59660dbbcb6c5506d22ab5ab5a5e2fe7b9d44bb83d8c2431863f23", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "log4j", "colour": "#B82EEC", "exportable": true, "hide_tag": false }, { "name": "Tsunami", "colour": "#BE6B05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646847601, "uuid": "41b1f7d3-7935-4ec2-8a2a-46ad9e8f2925", "comment": "Malware payload (Tsunami)", "value": "a9791ba664dff0e29020532152b5573649af1c71", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "log4j", "colour": "#B82EEC", "exportable": true, "hide_tag": false }, { "name": "Tsunami", "colour": "#BE6B05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646847601, "uuid": "48780153-fc21-4421-a5ce-a67784c9b084", "comment": "Malware payload (Tsunami)", "value": "2958abcbf668331b7abd3ae78690d3fb9d7b323ccbedcdf07d974b116cfbe6c86688810e76e3394a45ac0285f15f9d9f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "log4j", "colour": "#B82EEC", "exportable": true, "hide_tag": false }, { "name": "Tsunami", "colour": "#BE6B05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646847601, "uuid": "114ae99d-2e00-464a-a9ec-c7d669bc6bc7", "value": "T11113016970769B83F14B446E37CA1E6AF12660C95EFAEE5C3AD81D5F247B11C4BF0880", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646847601, "uuid": "5256471b-081f-4a73-a8c0-5df4d8c1206f", "value": "768:mUf0NjmKsnX4ND+STiEK3VUKDa9NgKw/mpct60+64CXHHmVXDjS:7kKKDY+9Ob7d6eHm5D2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646847601, "uuid": "544dbf98-f102-4dbf-b3ab-e9a9a0886dd4", "value": 44964, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646847601, "uuid": "dbfe1b8c-f7f5-4d69-a725-facad8ea718d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646847601, "uuid": "4ade67f0-cbc2-4c95-8d4f-2fc8304a3d81", "value": "pty4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7cb8c26-9fb6-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1646836738, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646836738, "uuid": "10fdba38-44b4-44b7-a33b-d38967b777f9", "comment": "Malware payload (AgentTesla)", "value": "b53f29fcdd0629a6aac61ae207e8d2e0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646836738, "uuid": "e2eb320a-5b16-4dba-8675-6ff077b5aec7", "comment": "Malware payload (AgentTesla)", "value": "17d9a19b3c297a3f894f3d934a78bdf0fd95f22df0038ddc23a127ab71f05e72", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646836738, "uuid": "e746b0b9-aada-4a52-9d9a-7b8dce0134c3", "comment": "Malware payload (AgentTesla)", "value": "cb9b7a324c022368487362df9ed40cc8148dc180", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646836738, "uuid": "d11b872e-70ad-438c-9433-08753e03a799", "comment": "Malware payload (AgentTesla)", "value": "f36f038b627a0ea15bc66e179e679d1df6d195f7d9a9aa45875b7c1a1355e5d1427972977aa923124a09a0715afd6595", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646836738, "uuid": "dabaa82b-d370-407e-b9aa-3c766e1d5098", "value": "T1F014026F2B7CC590E5948239FF7DA1F4B4DAECBA0692ED8714D0731EB6B61860875600", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646836738, "uuid": "e80cad9c-178e-4c2c-95c9-a5f736fed53d", "value": "3072:ifNqNNlQYAy9bqSNeSfYUwoyfoWRFJq/S5UWUg5j/BXpSbUTnT1:4NvnibqoPg9gTSSWUg5N0+T1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646836738, "uuid": "86c51119-07df-4f10-a82d-ef26514e5f5d", "value": 191320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646836738, "uuid": "e0757125-1dec-48f2-bafb-df203de3b48b", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646836738, "uuid": "27dda620-179f-4fe8-8775-66ba32efaadd", "value": "MICROWELL SLOVAKIA ORDER.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01cb3e15-9fbc-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646839037, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646839037, "uuid": "613e9faf-141e-4463-92df-9e30aac026e1", "comment": "Malware payload", "value": "e23c284c3d7d791df51347e399687319", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646839037, "uuid": "9cdcdbc9-6a9c-4c46-85af-9a4da10b1b91", "comment": "Malware payload", "value": "17dc9a1c147658323ee10781e547fb6a32291d068ced6b0c1372b91e7f8b75c6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646839037, "uuid": "bf1e347b-2f56-46b5-a6a6-a5b9a18b3951", "comment": "Malware payload", "value": "16c0ed501f48c7f168052508448f158d6934d3b9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646839037, "uuid": "3b61165c-b60f-4f2e-a861-cbeaa22ab439", "comment": "Malware payload", "value": "31e9a424b94d42a5427f8a63087d04e6815ffeb1ef4374f179ae2d0f4091ee8359e158c8cd352e47996ade16aa5ab2f7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646839037, "uuid": "4cd7fcfd-43cc-44e1-892d-1fedb15b2753", "value": "T1C7648E10BA91D035F1F712F845BA9378B93E7AA15B3450CF52D52AEE56386E0EC3131B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646839037, "uuid": "96e140da-d57e-4151-8207-a0c19579aef7", "value": "2eebe0dba96971c51a6bd6aeb0592251", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646839037, "uuid": "9d79fce8-0cac-44cc-8670-a2df564960bd", "value": "6144:HWlEXmZhvGj7K2TcsCzPD41Bf8nQU8Fll9CZzgb0:2KWZheHK2Is241heQUErCg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646839037, "uuid": "da35d4f8-4dc1-4b83-a055-2ad5006ed127", "value": 307712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646839037, "uuid": "de651d37-6d98-4fd5-b22c-0e93ba81989b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646839037, "uuid": "50ea6fcd-74f8-4a0e-9257-563c40daea2b", "value": "e23c284c3d7d791df51347e399687319.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e984e19-9fbc-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1646839246, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646839246, "uuid": "9b5cd66e-3650-4885-a9ad-ad86e196d219", "comment": "Malware payload (AgentTesla)", "value": "a6a579cdee022d4f76c2fa963d6ab3c9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646839246, "uuid": "979f5cb2-aac4-4205-939e-4055b7d63189", "comment": "Malware payload (AgentTesla)", "value": "17fdc0ff982ff2d426b2285b3c7acfb82944cb39f3431fd278082ab05251cd8c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646839246, "uuid": "be9594e2-e2b0-4658-9a35-09e9ea02f9a6", "comment": "Malware payload (AgentTesla)", "value": "7a771d9502709712ba15b693849ea4caf9bf797e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646839246, "uuid": "8c7d5cc7-527f-478e-83ed-369e49f9c4d1", "comment": "Malware payload (AgentTesla)", "value": "c8173c51600403709a1312d4932f58a20434ec8d76d32e09605279f0148efd46eb67dd0385a0ffa04373bc65d1721d79", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646839246, "uuid": "49ce9946-635e-4225-b113-004e53d06ed6", "value": "T1D925AEE629EF505DF337ABB12FC4F8CE596AEA73151A30DB10921B368423990CE61735", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646839246, "uuid": "28aa149c-03d2-451b-bc73-63c61e935aa8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646839246, "uuid": "8aa49fd6-fb6d-481b-8fee-20f21dedbde8", "value": "24576:bD5kI+qGs2E+8jJ50w3tGKpQy76CzrjAZzMBVZamiudI:bD5kIVGI50EtGKpb7/zAh+VZay", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646839246, "uuid": "bb1c2d94-6c98-418e-bcaf-41922db65eff", "value": 1024000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646839246, "uuid": "646d5a16-fbbf-4a9f-981e-5541401d7f0c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646839246, "uuid": "e84ce2e8-e3a9-4634-bfb1-19f406397f06", "value": "a6a579cdee022d4f76c2fa963d6ab3c9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed2583aa-9f45-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1646788322, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646788322, "uuid": "3e704d1b-f6ea-4a99-9513-8a64ef5e8eec", "comment": "Malware payload (Loki)", "value": "ead3f01afce6595aea6fedb0712d0034", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646788322, "uuid": "c8810e7d-c31b-4cfe-b2cd-66ff9126a40e", "comment": "Malware payload (Loki)", "value": "1816a19316181d9107bad9b5e6050a3a20328eab8ca6a7a4efab45ded9e5ba22", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646788322, "uuid": "7bedea2d-48f1-4200-af6d-b59ab81efcc4", "comment": "Malware payload (Loki)", "value": "872c06fe73dc4e41e369b2246048e84b4d68aab8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646788322, "uuid": "b63a5308-5bda-4808-a506-be471b916823", "comment": "Malware payload (Loki)", "value": "874560d19c0596a1b68713f4f1a8274f6178c1e25d2d9f3fbd6fb390626bb6b8e7a1225416f6d411c3c91f89e9bcbae1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646788322, "uuid": "179b5b84-2ba9-4478-93bf-f5e2c0f9ec00", "value": "T148158DE629FB405DF337ABB13FC8F8CE996AEA73151A30DB10911B7684239908D61735", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646788322, "uuid": "34f93179-3340-4fb8-96e5-1c77fde680e4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646788322, "uuid": "7a583135-d490-4419-8726-23ae1c19eca1", "value": "12288:XZt3Zy3WD5kPeuJf25/ydrDJeBISXBdUKe2fTKLfpaV/fqR3SjdIUx7DTvHI:jD5kmMf21crDQBIcNK0xfqNSpIU9TvI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646788322, "uuid": "baef8665-e313-4336-9886-fd6313771547", "value": 891392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646788322, "uuid": "f59f9012-ca56-466a-b09b-6bfe3eac97ed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646788322, "uuid": "13035f50-ac55-49af-ad73-b27e08af312f", "value": "DHL Shipping documents.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3681f2c4-9fe7-11ec-9275-42010a9c0029", "comment": "Malware payload (AsyncRAT)", "timestamp": 1646857594, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646857594, "uuid": "3d3a8095-7a43-453a-a667-4a8755c1418d", "comment": "Malware payload (AsyncRAT)", "value": "a1bf817873da728abc741a7a7ac1f204", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646857594, "uuid": "f3c737f8-370a-46d5-81bb-c783bf837268", "comment": "Malware payload (AsyncRAT)", "value": "18b4d933ea2f0cbc8ce181a7ef38a29d94822477c0198d16a39adcc038caac2b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646857594, "uuid": "c59274c7-f229-4ec2-859d-020da34ef6dd", "comment": "Malware payload (AsyncRAT)", "value": "4f99d126398ee4f9cb667a61c6d056d162de1c78", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646857594, "uuid": "58994599-3772-45c8-864c-ca0841834e6a", "comment": "Malware payload (AsyncRAT)", "value": "5aca33f0e0efb15448c551ffafea5528be03aa8f285087ce5e6809ce90b6a1ce8fe80e8af5dd1e182f4d1a08551e8173", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646857594, "uuid": "f5f6615c-1469-4b5e-89ce-c59b6400e800", "value": "T10C25582464E615F4E8768FB2CE90E7A1FFAA9911D84451BED0203DE24223BBCC545DFE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646857594, "uuid": "97f14eff-2e0a-4ced-a369-024284b070c1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646857594, "uuid": "300a5554-df3f-4bb0-8fa3-aaa7e3e0fb87", "value": "24576:vJViXw37AmKIIfVPVGQ/rNwitdhNc3gR84u4FUjpD+Sw8XKc:vJVx9IfVPVGk3tVegR84BUpD+Sl6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646857594, "uuid": "f5df0a2c-4c53-44f9-a1d1-9b42c7cd48d6", "value": 978944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646857594, "uuid": "5f90072e-fa16-4b25-911b-36a2ed827d71", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646857594, "uuid": "6a26b91a-36c7-4470-9090-e1bcd510f1fe", "value": "a1bf817873da728abc741a7a7ac1f204", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0dc5a87-9f93-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646821694, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646821694, "uuid": "c63532fb-9c54-44aa-8769-ff6918ac9464", "comment": "Malware payload", "value": "6ca06b1ef4c5061b475356a6c570e87b", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646821694, "uuid": "00a3cd30-cd77-456c-a168-36a191c5900c", "comment": "Malware payload", "value": "18d27bff9726b26fcfd0763723a41923ba9c1d0091e9d572d17012be04606660", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646821694, "uuid": "f225175c-84a5-489e-b97a-256a33d066bc", "comment": "Malware payload", "value": "a96a3cbbe3ce3d2e9914661173eb73b9f5d74dc3", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646821694, "uuid": "a2a5759b-1b9f-4a64-ba86-72a3163b93cc", "comment": "Malware payload", "value": "a87fa062afc5fe2523bbb1c92b87d31c29efcb256dc960135d57e1f122655a219f91638c6453bcf8282d2ca49cc621d4", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646821694, "uuid": "67137cec-3203-4006-bf8e-8ccbd4ede5c4", "value": "T17195228254A24FD5E82C653D94DF8F827A1CAB4A4086970F0736F77B6FB37F88965801", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646821694, "uuid": "5aa7fd49-ce59-40a0-a723-ba0be4298e0f", "value": "49152:cIoa7thIkh6OLiVO200ePknoEf597nQBEGEvxj6CaMWBIyP:zRhIGKOH0FnLB98vEviPBP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646821694, "uuid": "6b4c9906-7ae4-460e-bd44-43099cd3cd2f", "value": 1919472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646821694, "uuid": "17051542-5bef-4957-8f80-fdf32f318a6d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646821694, "uuid": "52daf5d6-b6fc-4c03-bd9c-45210188772c", "value": "SCANNED001.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c837d498-9fea-11ec-9275-42010a9c0029", "comment": "Malware payload (RemcosRAT)", "timestamp": 1646859127, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646859127, "uuid": "39b05d6d-afe1-474c-b04e-f9aa0c904a15", "comment": "Malware payload (RemcosRAT)", "value": "3e127879438db3d41868672aeb95ed7e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646859127, "uuid": "9f3d15a0-9861-486e-b1f3-cb9871faff51", "comment": "Malware payload (RemcosRAT)", "value": "18e00d21907a737eec59f97a9729076836b34a26adb9a66f0e5b80a0cd2d7176", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646859127, "uuid": "f3b1039a-cb8c-4b94-b3d4-a3da24cb1c3e", "comment": "Malware payload (RemcosRAT)", "value": "ebe16eb5fcdf5a681acdff6c3ff14fe37b72998a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646859127, "uuid": "093f8d6b-d362-494a-94b3-6748b17c282c", "comment": "Malware payload (RemcosRAT)", "value": "220c4f064df4f080709cd0cdb2cdce7e5c185ba5aad3b275687527e07cc40c377fd2ebf1c0bcad834678e6b79fd3e2fc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646859127, "uuid": "a4e0fcbf-06c9-4588-9532-37799b10d501", "value": "T11D55CF6633D66A44D07FAB38A57804C047F47A0BEB10D79E3CC641DCAF72E8667526A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646859127, "uuid": "e88d0e6b-4c74-4f77-a184-d1f7a3ed4cb5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646859127, "uuid": "85d4d94f-264d-459c-83ed-cf2888e620fd", "value": "24576:+8NAAlWJhOdBKTEncajBr1eNrZ1pkbZPi14JE9u:CAuOiQca9r1eT1p+ZP/O9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646859127, "uuid": "ea0cb31c-b5de-4eba-ae3a-cf13b5d715b0", "value": 1330688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646859127, "uuid": "13bfa1ae-efbc-4b92-b1f8-ea9f1ee6b8ad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646859127, "uuid": "4f0d91a5-f171-4576-9025-bd26b54bc9b4", "value": "SecuriteInfo.com.Trojan.Siggen17.22061.21253.748", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef93d117-9fb6-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646836859, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646836859, "uuid": "047b1ca4-ddda-48a5-a955-0362ea65e823", "comment": "Malware payload", "value": "821cfb5aef3daf821659497c9c9379fe", "object_relation": "md5", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646836859, "uuid": "17e59d63-f3e6-48b6-8b17-645725f0b530", "comment": "Malware payload", "value": "18f31ac2d71ac144e713f11c2fdd14391962af4b0e77192d3e790a36aeae125d", "object_relation": "sha256", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646836859, "uuid": "2ec13bf3-55af-44ad-96a9-2fc5e7b59c16", "comment": "Malware payload", "value": "81941b44abe7b4f641ecb395e866057e78f91e3d", "object_relation": "sha1", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646836859, "uuid": "460d257d-72f4-43c0-9a54-7ed9afd5fc62", "comment": "Malware payload", "value": "b9739d6d7fd8657232fdb7015d2c9317b8a38cacbd8271245d38b0cf2769293a256ac9b9f77c233eac03ad5400aa2c61", "object_relation": "sha3-384", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646836859, "uuid": "6e85058c-beea-4cef-a06e-b3eec2a67263", "value": "T1B5140264722ECC83F6B73B7B6D26EA34DB58AFC16428C94B12CD75A9FC740C205522E5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646836859, "uuid": "1eb54467-0ff6-468e-94b5-19357ee24bb2", "value": "3072:mrcFQ04bYTgW3MSvcasX3BeSRaUk34yKyEd0VKxKv/OYFwPQc/FHKrRgvWAWea2:A4Q040TrcKc93B3RJ01KyEW+u/O79zv1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646836859, "uuid": "e89bda3d-4ade-4163-97f8-7c95430cd024", "value": 190440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646836859, "uuid": "20047849-3add-498b-bb15-dca6b1a96122", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646836859, "uuid": "ddc6333a-6075-448a-a8d6-bb83ffd15627", "value": "EmailCCRO9841ING29374618634767137738163648377173.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66b27412-9fb6-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1646836629, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646836629, "uuid": "cf93e448-eae4-4561-9adf-71e95bdfa769", "comment": "Malware payload (AgentTesla)", "value": "28d20e6bd93612f3b153b3a2ea3776b1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646836629, "uuid": "5d344652-f3a8-428d-93eb-8049ac07560c", "comment": "Malware payload (AgentTesla)", "value": "1938a1ebf8ff6a4a3d84a5b3ece3764e89bbde03319dac9db8215e9f9548e5c4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646836629, "uuid": "7faeecfc-d441-42a8-a503-b297545dbb19", "comment": "Malware payload (AgentTesla)", "value": "9e17dbe26b3364fd4eb4ebebac0506627a0a68a1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646836629, "uuid": "d738a31c-e857-4aca-b7ca-a40bbd94dc43", "comment": "Malware payload (AgentTesla)", "value": "08c44abb3167c46e4d0a4da5b73cc4d773188f8bb04b227e36a44db2eae005947ec88dc40d0d7509cd840aeb55847f65", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646836629, "uuid": "2edb743c-a18a-47aa-8134-b60964407e15", "value": "T16225AEE729EB405DF337ABB13FC8F8CE596AFA23151A20DB11911B768423A90CD61735", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646836629, "uuid": "9ffe409d-91c5-461f-8ad0-cf6dc912dcc9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646836629, "uuid": "922d74ae-9c04-4a52-93ea-4f58cc5983d3", "value": "24576:YD5kzWMTtOuGaajkjEaBcOgK6B1xBr598HI:YD5kzWMTQF/UGX3L5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646836629, "uuid": "c71a2759-bebc-4079-971e-538a33d62180", "value": 1021440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646836629, "uuid": "a98c4e32-96a3-4280-a7d3-373031b013e5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646836629, "uuid": "27397c37-9163-441f-b2df-5d692c4a96ea", "value": "SOA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "464fea9f-9fb9-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646837863, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646837863, "uuid": "742ae988-caa5-4e6c-96c4-7cc4aadfb1b8", "comment": "Malware payload", "value": "8ade0a04317db340d7dcdc9a4b32c795", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646837863, "uuid": "33002c3b-817c-4d0d-975c-6df153357e80", "comment": "Malware payload", "value": "1aa032a3d316f19de0c0946185eb7331aa1270d52882550c867eae1ce540ade1", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646837863, "uuid": "a8c9fe7f-10d4-457c-985c-617c17aa01e0", "comment": "Malware payload", "value": "30350a6e2339507039e86a68a99958b1d9dea157", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646837863, "uuid": "10cb90b4-b824-4e01-be78-5f48435bd516", "comment": "Malware payload", "value": "33f1e46ca4121724a001271710b190fa21f84fb2daeeb0c2f0e7d9dd691a8c790a3d8e4bbc4729cf63d0c6a164a093b4", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646837863, "uuid": "03ed58f3-d0de-4964-ab22-0a9efc7ce945", "value": "T1F012AAF1EDC43B8797DC93E72AA916DD89D405D29BE74A8C310B314EF37D81A22488B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646837863, "uuid": "1ca38dc3-edce-4f2c-b37e-193cd1467471", "value": "192:xF4ViaUi9uow9VpPrAsFs8sCsNs6YsoKAsOs/sIsFs6Ys4sasOsjsds6Ys4sSsdw:34ViaUBLuDtW6Poo5E/u6Pvl5om6Pv9m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646837863, "uuid": "6e1846ac-5a37-4006-ab31-2a3831683694", "value": 9801, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646837863, "uuid": "fd6388a2-333f-410d-bee8-cef1a2c61705", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646837863, "uuid": "4a1e28ec-d693-4fc3-a727-74036d2c9433", "value": "KVDKGYBAXAKQX_PAYMENT_COPY.VBS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ab73f39-9fbc-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646839052, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646839052, "uuid": "1126d2c9-16ab-4e38-9174-5e8cf5369cda", "comment": "Malware payload", "value": "4e3b576f779b16de5318cc575e937208", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646839052, "uuid": "30ce1bee-8c6c-4d29-99ae-d90d07b9288f", "comment": "Malware payload", "value": "1aaca1439381889a4ab25f70b9df25309550100ff46ea1ee1f080f1bcab21795", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646839052, "uuid": "ef18c745-474d-454b-a05f-4b1d9936347b", "comment": "Malware payload", "value": "802d7d58a83cfe09eb1945dbe602542d50be74b0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646839052, "uuid": "7de79306-a725-4338-8e5d-4a20e2b25383", "comment": "Malware payload", "value": "f5021be540e704fcc191fd3b1f58d3c96c0a813c4aec1927170d0221ae5306d467da7e2afc9be09b4c1711e476f4eac8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646839052, "uuid": "86792d9a-016b-4d8c-b10d-f59b91f70054", "value": "T1A1063384F92DED61CD29CD7D21887C2F574E06B98E2444ED21D284F199BEFE09F94B88", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646839052, "uuid": "d10dc25f-28c4-4bbc-ae32-09622b168a37", "value": "49152:LjRaDfWMTI4IOch6TNXR0gKDnZ5wMgAj9Otw9jz3HNZdKDUpBnj17XXXITb:MD1IrOK6TNDQ7ngxw38DUpBh7Xsb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646839052, "uuid": "ec9244de-f23e-454c-9f65-6987a87175f6", "value": 3703721, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646839052, "uuid": "a498a737-8dd0-44d5-8067-243cc1d605f0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646839052, "uuid": "ec80258c-e253-4f2a-8888-4245b4eb185e", "value": "4e3b576f779b16de5318cc575e937208.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49dce092-9fac-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1646832286, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646832286, "uuid": "f007bbcd-1a60-4f7a-8401-2b3b887707e4", "comment": "Malware payload (Formbook)", "value": "8ccc15c0ab3fe59a6150b634eed14c16", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646832286, "uuid": "798e910b-fb5e-4da6-bac1-da76840947d9", "comment": "Malware payload (Formbook)", "value": "1ab5db2779402923e3943bef3f40e42d3b4b1b70214d3972a9d6bcb11dc71be8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646832286, "uuid": "21d8e3e5-fc62-48d8-b451-3951dea7c5d2", "comment": "Malware payload (Formbook)", "value": "cfde0e740ef62e894f97dd8e26b443a5820f30b2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646832286, "uuid": "31834d70-039a-4dc9-913c-f5a781500b27", "comment": "Malware payload (Formbook)", "value": "857b8f0876c75a0d38ff4abaccd81da928279fdf4e359bd3b4658037ad18b071d93273d734cb584c3e3e2b2213fa2187", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646832286, "uuid": "931a1871-9c6d-48ce-b3e7-a04ccdd69e5c", "value": "T10274230159C074BBD7AB4B306EFBA3FF96F75248259809236F202EB55FE02B9C55A1C1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646832286, "uuid": "1ae0dbb0-cb28-4666-ad28-83644a351146", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646832286, "uuid": "21d568ad-52e0-497d-8791-bbe5ea0f5e20", "value": "6144:rGivRBw1tw3+dXBm/YfJ4/pLi3pnwBNhq7e2jFPcgdSsfpZpR5UhwYZLPia:tBeeaxm/8y/pqpnw38awKgdLRZgLP3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646832286, "uuid": "d600b34e-95b9-4a2a-ab9a-a8aa7b166c68", "value": 344288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646832286, "uuid": "5795126a-edd4-4b05-9e0d-aa165ea0450e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646832286, "uuid": "71eb2bfb-6655-4844-aa55-91b483db29f2", "value": "Outstanding Invoices.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ce16002-9ff3-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646862678, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646862678, "uuid": "1e40b79d-ad72-4f9b-83a2-dbab944b268c", "comment": "Malware payload", "value": "340b2ee929523ab25108a317c9f92dc3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646862678, "uuid": "8f17cfc7-f08d-4c4a-a0cb-0f8a6689e654", "comment": "Malware payload", "value": "1b18ad52cee72269d1fc0079d2e04368402c8f528f528143403ebdc9fcb4d105", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646862678, "uuid": "8b22ffcd-6b91-4f91-b5f8-7d69e0a87abe", "comment": "Malware payload", "value": "9953e770a42c8a59647daa9ac7ae907db2f1f1bc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646862678, "uuid": "bcde9f8c-b2dc-43cb-bfb8-dbea56f2f09d", "comment": "Malware payload", "value": "bbf2bfc1916668cc7db9b54ff394c89eb61370b3a7af7b3e323d19167013f792880f088912334b071ded43c6f850b1f4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646862678, "uuid": "13f2e459-ea00-4179-bc9e-b70c2e4059d1", "value": "T1149273083BD8412EDD7F4BB55BB54149822ABACB96B3D61C18CA05180DF8B54C69FFB2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646862678, "uuid": "01669fda-331b-42fc-97a1-41ebcaa18ae8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646862678, "uuid": "04b0b45e-9421-4ee4-8371-54d2d0f796db", "value": "384:uGNZ3Nam0oCxWu/ASTChaafCPmUWUgUEUI01RuriODl:1HFCxWu/ASTWwM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646862678, "uuid": "71f0c65a-95cc-416b-99a5-b1e3a7bbd22e", "value": 19456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646862678, "uuid": "04acf20e-9dbb-4ced-a5e8-56c86399fd63", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646862678, "uuid": "0ecbb1a6-d121-42c6-a906-6ad87e76ef3b", "value": "SecuriteInfo.com.Trojan.GenericKD.48381321.27094.808", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3b20815-9fe3-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1646856139, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646856139, "uuid": "51cd84f5-6b9f-4f1d-80bd-ae81c3bc02f2", "comment": "Malware payload (RedLineStealer)", "value": "a25d8eca92ce07ed3e2c7669d77c2564", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646856139, "uuid": "2554cdd9-87b3-4da5-aef9-b7e095b70aa9", "comment": "Malware payload (RedLineStealer)", "value": "1b4b9433538da83a4a25ae6c288398a8aa9bf79cb8a532666920399bdd6af51d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646856139, "uuid": "0da92e46-1b8d-4023-9c7c-c2d063a6a876", "comment": "Malware payload (RedLineStealer)", "value": "0344264e0b87baecdae4802c18ddb910d608948c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646856139, "uuid": "16c39136-95ad-4ced-81e6-47d323b9420c", "comment": "Malware payload (RedLineStealer)", "value": "85bc6c4736324fdfc826cc46e09e1f959f3c2510bc0c3c7e4292ad442df5029d3af34268be25df9549d60c1f1b88f573", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646856139, "uuid": "4083497c-982e-4a60-9383-c40900886b35", "value": "T1FBA4AE6AE6914E40C5752A36E0B3CC5D03C3EB9923B3E7ADD8A7405B1F533BA5C812D6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646856139, "uuid": "13d68e1e-204f-42a1-ab58-c52b1fa986ed", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646856139, "uuid": "5e4a2802-967b-41b9-a651-3ce3c3ca45eb", "value": "6144:GdadQTXr66nIwHWP1p8d6pN/WChIN6XQezDVs51bkaWYSYw32kzaqvA+UI9NPKz8:Gdv66nheIN6AOxs5BTSZvAuvWeZvf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646856139, "uuid": "3d3e32cd-d1a1-4e72-9eed-2b2f16878be8", "value": 480512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646856139, "uuid": "e2b808fa-d7d2-47fa-96be-097723e9a291", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646856139, "uuid": "0559ef05-0c5f-47b3-969b-baec1459b59e", "value": "a25d8eca92ce07ed3e2c7669d77c2564", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6056700f-9fba-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646838337, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646838337, "uuid": "a7600c4f-45cf-4b96-8059-7496c9790753", "comment": "Malware payload", "value": "b3f6734c8c6eb4cdcf634e111ee3d847", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646838337, "uuid": "b760924a-a852-4335-af7c-0343c7fac6f4", "comment": "Malware payload", "value": "1bec8b297187635715a55b8fe91acdb937db4ebffd6f7546aab0d4103322bd72", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646838337, "uuid": "a4676fa1-4a4a-4fac-842a-70414e37114d", "comment": "Malware payload", "value": "a355d55b99bf053a78f55e8aa7442eab95faa8d7", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646838337, "uuid": "888eb7fd-cd03-4f13-b39c-7f745bd5565b", "comment": "Malware payload", "value": "9b65e310c351c303ec241f1dff56d310933e3378d45a63a3ebabc9521ab829ff75562d2d7bc84821727110a8dd2105c7", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646838337, "uuid": "9851495e-21a9-4e99-a87c-626e52af56d5", "value": "T1E8E55A23B645B63EC46B193A5537B31CBD3FAA6165329C1B57F7088CCF268402B3E646", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646838337, "uuid": "3a97a2e7-2295-4a9f-9de6-e7710ce4bcd6", "value": "49152:SfsyG0+rQsbzoRQS8nDwzWNolnwTzLzGYS3A:nVzK/lkzGYOA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646838337, "uuid": "ab0f9689-3fad-4344-8976-43cc1f9c6d1e", "value": 3056128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646838337, "uuid": "b23e1c93-78ed-4d8d-b0c1-3983c0665aab", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646838337, "uuid": "d65e3a01-5682-44db-a3c4-7568c97f887f", "value": "NotaFL.IplaceDanf08032022.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5238f8a2-9f8f-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1646819845, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646819845, "uuid": "a70be9ea-7df5-42b2-b4b0-b8d62222eafd", "comment": "Malware payload (Formbook)", "value": "6d790f3b02af4f9f3de683404ff57dd2", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646819845, "uuid": "20f166c4-a5de-4dbb-865b-0493733489c3", "comment": "Malware payload (Formbook)", "value": "1c1975697dc5223f7b49f929f2cd7b7ea56f1e82fb7a0851a35feec1e05ff565", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646819845, "uuid": "3ad1a42e-37a7-4f3e-9947-f9f91e19640b", "comment": "Malware payload (Formbook)", "value": "0241788066addcc3a4a4d7798a5d7bf276492753", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646819845, "uuid": "e3cbeac4-867e-46de-96ca-d64276daee1c", "comment": "Malware payload (Formbook)", "value": "729022d32214c1d97c5badbf936216930bcbc59e035c3df4d5c7277f842a3bdc9358919d3c9683d9f9d6a91271ee1e19", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646819845, "uuid": "56416d3b-0dd3-4dd7-a5f1-6b34f0420e41", "value": "T1E10533695D7390B99B8E41D73EC3B3B597538BF8298A9871F0A7FA25404C9C188213FD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646819845, "uuid": "a51ee18a-372e-4b2c-ac3c-b63c307a077d", "value": "24576:Y5eBNgscPIUc4Iklu1HQrq2G5akArohjkrpiri:Ye8sTklu52vrohqj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646819845, "uuid": "a9470861-48c8-4bc4-975a-331ea247ce23", "value": 818427, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646819845, "uuid": "42732a7d-48cd-423c-ad7b-9b95b3e85395", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646819845, "uuid": "b95e9fab-e372-45d0-ad24-8bc3a852d4db", "value": "PO.r15", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "578ec510-9fbb-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1646838751, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646838751, "uuid": "fce13632-e0b1-43fa-97d2-b3c7a8b2242f", "comment": "Malware payload (AgentTesla)", "value": "cf27f3b7119d6f8318a2108f25efd7f1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646838751, "uuid": "2fa5b6a9-6b9b-4f1e-a3ae-4c83701929f4", "comment": "Malware payload (AgentTesla)", "value": "1c75bea3faf986032ddde6fe1d032b932795bc6dd88e06983498f74c404a7b8c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646838751, "uuid": "44f7784d-b1e3-438e-a306-62e1e1817a48", "comment": "Malware payload (AgentTesla)", "value": "7ac05721c4b01097e478b73e1c85de701141e49b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646838751, "uuid": "0e896e28-c64b-4a32-9f79-a28de3591f5a", "comment": "Malware payload (AgentTesla)", "value": "d4e4c5c2c254a70ec4c58b29e88fc13ecac3b7711110da43ee5ead845ae2109e4032c110db396e08e6709fdb53ee329c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646838751, "uuid": "78cdd606-cfd0-413b-88c9-0dc521486020", "value": "T149259DE629EB505DF3379BB13FC8F8CE996AEA33161A30DB14512B364423990CE61735", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646838751, "uuid": "4f470de5-88cb-4c23-8c5c-02aa7e13cfdd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646838751, "uuid": "9f3d1841-8435-42f3-9ef1-365c7f6fb492", "value": "24576:mD5k5ShV8WqgbD4ndGa6nm3ZecQ2nb9y9hI:mD5k5Sr8WHKAJwHT9y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646838751, "uuid": "82b6c9ae-2547-4231-b284-ae11f91b2c9b", "value": 1011200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646838751, "uuid": "f7ce69de-5d85-4c53-9262-b401720de789", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646838751, "uuid": "61695bc7-0093-4b07-90e9-29fcca8646da", "value": "DHL Shipment Notification.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42e4ebaf-9fe9-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646858474, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646858474, "uuid": "c1ca706b-c544-40f8-913a-e210e7475d89", "comment": "Malware payload", "value": "900bf557b369be9a6d8ecf4eab8eb7b7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646858474, "uuid": "00ef0da0-1a1d-4d4b-9dee-f8d8434cda7d", "comment": "Malware payload", "value": "1ca0216d0d70df84f12b955ad54bc99c42b783320de730f7edb060aa4cf5e0cd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646858474, "uuid": "71647f29-050f-4a52-a86f-009e4417c5ea", "comment": "Malware payload", "value": "3ffcf61a3802bfb138e3b2090fa382e7c2e9b0b6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646858474, "uuid": "a5a30cdf-02cd-4649-8daa-323d04419dfe", "comment": "Malware payload", "value": "bdd6ec55c31e07e0c8bbb607117f2af93560f3083daa23ec8285f48cc325f9fceb6543bfebd98ae9576c9ac743ac0d11", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646858474, "uuid": "0fd47aa2-0733-49c9-8555-5184acb8cbb0", "value": "T1B8438DE0B187507CD9DAC6311AF9A3EC6BF5B8DAE587C54B4E72AD0311D62872B1031B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646858474, "uuid": "f7e5b3c5-c135-4f99-97b5-9d827ee14ca3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646858474, "uuid": "708194fb-3e30-4d99-b1c2-dfba8e60e538", "value": "1536:g1wWBnlJYqw/uVo/Nygw+2yQwGV1yG2sv9y33+86ODc7:WwWBlJYqw/uVobw+29yx/zc7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646858474, "uuid": "fea80957-516c-40f4-803c-a4aaeb20a68b", "value": 59392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646858474, "uuid": "7d31fe36-f549-41e5-8d50-48a8e1bc1c8b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646858474, "uuid": "b69b7fb9-fff0-4800-8134-6991a529531d", "value": "900bf557b369be9a6d8ecf4eab8eb7b7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "457b5ae3-9fbc-11ec-9275-42010a9c0029", "comment": "Malware payload (DanaBot)", "timestamp": 1646839151, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646839151, "uuid": "130b1f87-fe54-4108-bfe8-eaf8f15b2a01", "comment": "Malware payload (DanaBot)", "value": "cca8d03e6f36957083de297be9a0e07d", "object_relation": "md5", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646839151, "uuid": "7da9529c-2b20-4508-9c71-73cbbe22b502", "comment": "Malware payload (DanaBot)", "value": "1d2550887973db494368efe5dcf10ab5c8b4acf0d29ac0236e6e0910328b1d4b", "object_relation": "sha256", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646839151, "uuid": "8aacd2b1-4092-46f6-a0fe-91b3e1a059e2", "comment": "Malware payload (DanaBot)", "value": "b5cf2bea03d5f359f6cb0627e4cfdadb7047b23b", "object_relation": "sha1", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646839151, "uuid": "68a3d5c0-d07b-42ad-97cb-a12372f8ab27", "comment": "Malware payload (DanaBot)", "value": "e15d257bc4a1a841c8ba89d0d04757fd35697c905c2666a5424b0e67398792bda7b9d59a3c0580d6d72eceba65036da9", "object_relation": "sha3-384", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646839151, "uuid": "40155a89-fac0-4026-a4e8-19394082094b", "value": "T1C535223B3AA1C531D116F0319916CDF2897DBD60A6A5870F73921B0C1E727C4A8A97AF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646839151, "uuid": "ca01625b-eacf-405a-96e5-e902aaf10e8d", "value": "120d5f35bf3d408d95409773c543e6cf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646839151, "uuid": "8504941a-f9c8-4d19-8120-36c69d0b491b", "value": "24576:hJ50klXbXEqYnmzm/qHAd+LrV3TELJ8iZP:hJ5TL7YnmzmqHu45G8UP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646839151, "uuid": "3fb46c2b-9f04-4a81-b5ea-57d2a37b67b6", "value": 1145856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646839151, "uuid": "c06d3943-a01a-4ec0-8a96-12ea01ae3bd6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646839151, "uuid": "37296ac2-5ccc-4807-92ae-72a20d5666ff", "value": "cca8d03e6f36957083de297be9a0e07d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a0a407b-9fb2-11ec-9275-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1646834971, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646834971, "uuid": "947e1d5d-059b-446c-aa14-eeaeccabd1dd", "comment": "Malware payload (SnakeKeylogger)", "value": "18c9f1bda05cf4e86d6ca40df125c3bd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646834971, "uuid": "9668e2be-2932-4efc-8b33-08e5240fccdc", "comment": "Malware payload (SnakeKeylogger)", "value": "1d99001d3f0deaf5d5a81fc800892b1032dda1f5b1856d13be9b9478015dcb3f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646834971, "uuid": "f67c841c-5af1-4f46-8093-b86414487a57", "comment": "Malware payload (SnakeKeylogger)", "value": "9581fffe3ae6cd507552c27da9733ad4ad90861c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646834971, "uuid": "9c1debb9-1679-4300-b808-3a31fcfed494", "comment": "Malware payload (SnakeKeylogger)", "value": "10e71795f7748324fd7b2ae117c39a35d6c21262c4f5491d8adf13932e6a2ee984fdefe3dd5c8721aa2441d0e321390a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646834971, "uuid": "3c10c0c2-cc97-4d6b-a6c7-83ee0fe8b38e", "value": "T1A3158DE629EB405DF3779BB12FC8F8CE996AFA33161A30DB10511B764423A90CD62735", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646834971, "uuid": "7000cbed-f61d-416c-957a-072be62feb81", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646834971, "uuid": "5d971440-83dc-49c3-a1b6-a27262b1211d", "value": "24576:sD5k31twvZ1ASP/SksV38lGpM4xn9I2p4I:sD5kHOPASHSks2lGMe9F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646834971, "uuid": "692a41d9-4694-4313-a448-11454c67467e", "value": 913920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646834971, "uuid": "ae7749a5-0b4d-495a-ae6d-db209139a1c3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646834971, "uuid": "fe6f0749-84d1-4de5-9840-cd1d1910ddf9", "value": "BID No. 2000541001- REQUEST FOR QUOTATION FOR SHORE APPROACH SERVICE & EQUIPMENT-H02768 LTA2-43-BERRI DOWNSTEAM PIPELINE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1c49713-9f88-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1646817025, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646817025, "uuid": "623d94b7-1f7b-4203-9b84-2247dc6863fd", "comment": "Malware payload (Formbook)", "value": "135391c7e5d395e4b31b2b2d1b5a728f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646817025, "uuid": "04e316b0-6efd-450e-bfce-3ab94fe6a644", "comment": "Malware payload (Formbook)", "value": "1db0c14308c42fd03886fdef546388f61558e612fce7f7043c28c822ac0c9b5e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646817025, "uuid": "37c80145-ba8b-4a59-a62f-30da75bb32a5", "comment": "Malware payload (Formbook)", "value": "415801d7ced5b692236c44f42bb84b21233228c7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646817025, "uuid": "7b40c20d-588d-4911-87f1-e91af366df2b", "comment": "Malware payload (Formbook)", "value": "62fb5f5987f996c52e9918ecaa1f5ef4aa5d95814a0a64c8b9ed836094835643aafffdc0bd2d1aed7971642a91ec7cd1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646817025, "uuid": "91e39593-eebf-4dd2-992c-678dd56281c6", "value": "T1C2F4A39C393039DEC967D5719AAC1DF8EF923C76831B510B981731A9993C887CFA44B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646817025, "uuid": "82125731-b396-46e9-a7a5-47f20227cb50", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646817025, "uuid": "b2ad5b5d-2da4-4c15-af69-8759baba605c", "value": "12288:0X8cQO3mL9rUPf5jOy1D05Kof2rq41zVsAsH5AmObT3/4wZpCMkJvgOQpJD70UGu:0nSL9rUJjn1Gf2OImrHU/qUZZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646817025, "uuid": "dd73277e-1c02-40c9-91b0-b37aae485105", "value": 792064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646817025, "uuid": "0657b6f4-02c6-4cbb-aece-c6bba37d08fb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646817025, "uuid": "9149a95f-f8eb-47bb-b8c9-885b0175e720", "value": "PO8760432022.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b384671f-9f74-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1646808411, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646808411, "uuid": "42ad1c69-8b96-474f-ae9a-721c273d7c3a", "comment": "Malware payload (RedLineStealer)", "value": "a7b898143a02ef15ccfe04a5984205aa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646808411, "uuid": "f695ce1f-d4ac-47a7-9c69-8365fd92fbc2", "comment": "Malware payload (RedLineStealer)", "value": "1df10f51257273351d2ba547fb53e7d8bf0ad3fcb82977e72c9a4551f3a05e9e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646808411, "uuid": "67f1bc85-91db-49f5-8c78-65b9c461c1ec", "comment": "Malware payload (RedLineStealer)", "value": "0ac18ab729ab3ddd76eb50acfe32db37789e3da2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646808411, "uuid": "d65ec1d1-612c-44c1-aa0b-38eb6d387df7", "comment": "Malware payload (RedLineStealer)", "value": "49d0488edd923b0ebc9cb84d367e72dca10247299ceffc73b842659fc9a5b13105466aa1f2dbf93a2e319621710ac6df", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646808411, "uuid": "7a422b80-4a2a-415e-80eb-f7dc2ac4e8e9", "value": "T1A7F53345B14186E3F9315FB8121EB814CA65295AA64C7AF19C3F0F2DF053A660FDEB2C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646808411, "uuid": "577b7a04-3666-4096-aeb1-f536ec3e56d3", "value": "49152:qCHlZwA/TH1LUK2bm8uOkDgP9fdm44EAa+NB6nemPxJUWiAah3OBz4C9QdctC1un:vXBrsMDqRdm4Dem7UZk4N0bL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646808411, "uuid": "a6c2ad95-ba08-4f2b-88b3-098b3fb427e4", "value": 3439540, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646808411, "uuid": "671a9383-ecc8-42df-985f-2b9a29c94a74", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646808411, "uuid": "73687f04-eea8-4746-90e9-8708777ad7cb", "value": "FileSetups.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6cc6a7fd-9fb5-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1646836210, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646836210, "uuid": "3ab2b6e0-8a80-4808-a33e-ff80567075fb", "comment": "Malware payload (AgentTesla)", "value": "e29d48b35d56e427dde5cd64906dd87b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646836210, "uuid": "b63e1b30-3912-4892-a407-eee3bee92e34", "comment": "Malware payload (AgentTesla)", "value": "1f22331fb0b0dc20a2b688e8055d77f0c48358b20a0bfff91bc22ca36dee44bf", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646836210, "uuid": "2453c73d-43fe-4812-aacf-80217f587730", "comment": "Malware payload (AgentTesla)", "value": "baef719d060aea19b877794f8c34c06c06563353", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646836210, "uuid": "573ebb22-fdac-4222-9b7d-7631d27b361f", "comment": "Malware payload (AgentTesla)", "value": "fb18ddb8d4c56ffffed9d2e40b481e99634902381ecb0ee052a5c735f608288e35d1c877adb5673215c87d8e7f981238", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646836210, "uuid": "8c50ea56-4da3-4ec1-8b78-628a768e404e", "value": "T1BDE423A02D404AA58FB23F7AB34D9F68BD70A48B5C5762F5E0187354587323AEE1F44B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646836210, "uuid": "4e6063f9-7f9e-4816-846b-4cb8023035d0", "value": "12288:/CV/92I5mk7Snf9b6zeCXvSreZpkXdDY0h8Ig5hCIfe7lSNUf:6V/9vD7Snf9bcFseZKXdDY0h8Ig5hCay", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646836210, "uuid": "11bef11b-a394-41e3-bda5-79a0056d3293", "value": 659848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646836210, "uuid": "391aeca7-da83-4071-904d-850b31cba73b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646836210, "uuid": "47fce51a-47ed-418a-907a-3f71a13cb141", "value": "TELEX.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78364c2d-9f86-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646816043, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646816043, "uuid": "76967e57-9908-4f8d-a415-646cd57e2fac", "comment": "Malware payload", "value": "01ae141dd0fb97e69e6ea7d6bf22ab32", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RURansom", "colour": "#71CD12", "exportable": true, "hide_tag": false }, { "name": "Wiper", "colour": "#614E92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646816043, "uuid": "a1f2332b-59ab-4649-894e-0c588d8e3ac8", "comment": "Malware payload", "value": "1f36898228197ee30c7b0ec0e48e804caa6edec33e3a91eeaf7aa2c5bbb9c6e0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RURansom", "colour": "#71CD12", "exportable": true, "hide_tag": false }, { "name": "Wiper", "colour": "#614E92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646816043, "uuid": "76e00fab-776b-47c6-82c8-4cea3d717599", "comment": "Malware payload", "value": "c35ab665f631c483e6ec315fda0c01ba4558c8f2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RURansom", "colour": "#71CD12", "exportable": true, "hide_tag": false }, { "name": "Wiper", "colour": "#614E92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646816043, "uuid": "f8423203-6fcb-4309-8690-1431682ba4e8", "comment": "Malware payload", "value": "c85964e89c395409c09e19a1cd2c366358f679aacff118caa51e6a876fe6631aed43df62c0a0d218b38923cb3db3e621", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RURansom", "colour": "#71CD12", "exportable": true, "hide_tag": false }, { "name": "Wiper", "colour": "#614E92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646816043, "uuid": "c95331d8-51a7-4116-bc54-ccb988c29fc5", "value": "T173642361639CCF23D1BD03F92F49A11566216B75BEA0FEB68FD1A0941A03BD4086A3D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646816043, "uuid": "63b22a2c-a832-44ad-872f-33c7950f919b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646816043, "uuid": "8bd8eead-9aac-4e6b-859c-85cc121e90fe", "value": "6144:wxeiSZtKsAFK+d3Y2dHpPKtU1s8ngTec/4qjbRn7Fm+oxZfhl0:Q0PF+d3YcpPv1s8U4qfRn7duZfT0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646816043, "uuid": "04d38352-ea00-43f7-8b30-c7cb54c490ae", "value": 308736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646816043, "uuid": "3c9db6df-6f50-413a-b657-3984d606fbc5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646816043, "uuid": "793073f1-3108-4771-8c9b-c31e7e04b2a6", "value": "1f36898228197ee30c7b0ec0e48e804caa6edec33e3a91eeaf7aa2c5bbb9c6e0.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "474fabda-9fe9-11ec-9275-42010a9c0029", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1646858481, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646858481, "uuid": "9e6b2c00-64e2-47e4-9c27-35f9733ae9ab", "comment": "Malware payload (RaccoonStealer)", "value": "ee252c585d12552ccae1c900e5e97026", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646858481, "uuid": "c8a1255d-85af-48eb-ac63-5fb7d0f2b222", "comment": "Malware payload (RaccoonStealer)", "value": "1f7b4f7177a601ba168f0aea91ea7f3e517cde434fbd30e6417a757e85d16663", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646858481, "uuid": "0943dcb7-5ef0-4c6d-af14-34d90908a7f7", "comment": "Malware payload (RaccoonStealer)", "value": "9e9c72184715f5f8ab4808b08fb9c3ab1d725827", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646858481, "uuid": "ac88af36-fd93-466c-97db-ec3cbb26cfbf", "comment": "Malware payload (RaccoonStealer)", "value": "be14a76c04b6d595236f8a6cd1f21bfc5bf04f03636eff1e3e6dcf53e451253c147c4ef5e419fe4c7556d4eb0576ed0d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646858481, "uuid": "f1d758e9-68c7-42d0-8e98-ae203fd5eb9c", "value": "T163F4E110B690C036E1F316F8957A93A8B93E7AB15774A0CF63D56ADD46392E4EC3130B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646858481, "uuid": "07cc2a93-5050-42fa-ae34-6f35035dbdef", "value": "0ca9b05a489def699a29df5061ef8fa2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646858481, "uuid": "904bcd1e-a493-4cf6-be18-372c69ed0bb2", "value": "12288:Se21zQdXxmIQuDWjRIsG9zMLCSAWzsdREkApi:qiXQ5EV9zMGKQdGi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646858481, "uuid": "13a179b1-d149-4b17-ac85-7b65a69b06cb", "value": 741888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646858481, "uuid": "503c2d8c-f103-46db-a194-a6e51bd95d88", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646858481, "uuid": "740f6ff8-b8ef-4444-9ad6-f017c5c182b5", "value": "ee252c585d12552ccae1c900e5e97026", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02e767a7-9fb7-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1646836891, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646836891, "uuid": "cad73773-141c-4020-932e-d21cdf193c47", "comment": "Malware payload (Loki)", "value": "c9015b0d03bd44daf737338398e78de2", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646836891, "uuid": "e3bac3ec-0603-4b63-8e86-0cd5645cb5db", "comment": "Malware payload (Loki)", "value": "1f91a817371eab9e3d294e0d5c37bd6072d2cc4982a2bcc9ea1860fb4ab6733a", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646836891, "uuid": "2e9a1471-1a4d-4812-890b-03b70ebeeac4", "comment": "Malware payload (Loki)", "value": "2a250678d2c2ecbd031ff7c3d8ea1ea6412f3202", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646836891, "uuid": "46d01616-86e3-4658-a8ea-afdcca9ad519", "comment": "Malware payload (Loki)", "value": "e8ac7a5ac852cca4a77b338af0d81ec479f631d57285e36fc0b465b41daa77d648553460c20cc203849ed58a79b492d6", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646836891, "uuid": "624c8198-0844-4cda-95a6-a432f1cf8bb0", "value": "T1981412D66D3D2A0CC1763B7E39E99B05CD11EDE87906114BEDA272DDACF028DC607429", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646836891, "uuid": "10f01eec-fcc6-4f64-ab4a-072b9a0eb134", "value": "3072:w8BNaG0o1ICxKlNiTkQimv82y2W74b3iK535mYaHDSRhX:ZBNaG0o16l4AvX74b3iK5/X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646836891, "uuid": "f3c6085e-f6e9-41ad-b8d9-38e443df0e52", "value": 190952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646836891, "uuid": "68140c87-2854-4a65-9a06-12cfe838494b", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646836891, "uuid": "4d9690b3-efb3-4a89-98ff-98a154c47a5b", "value": "Factura Proforma.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afa11d84-9f89-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1646817424, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646817424, "uuid": "6d14c330-fbe0-4b09-9e2b-510c568034c3", "comment": "Malware payload (Formbook)", "value": "ffeddf32a21d953c5d05883b953481b1", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646817424, "uuid": "9a99abe3-07e9-452a-a453-52f90d674229", "comment": "Malware payload (Formbook)", "value": "1fb9d7def4c16090d7429cbf2e398b33f285971230b69f35a16a11dc817853d0", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646817424, "uuid": "ad54bff9-344c-4c46-ab49-ec209ebca976", "comment": "Malware payload (Formbook)", "value": "c408577351cdc57bc95a18fc7804f54f71b375fb", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646817424, "uuid": "7df2a70f-0575-4b9e-9586-50954c07cba8", "comment": "Malware payload (Formbook)", "value": "f3f63f0d3fa36194f8ecdbdca916fa7ce5feb906e09608af37829c04fcd8fd953848801ac532df6225d09b0112a18881", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646817424, "uuid": "2ef1acac-bb33-4c6b-bdea-3cfc4e8d0628", "value": "T159E433CD9E57651EDA719167811BA17A2ACF03AC030E80A9BC508F38F7B395F1C761B9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646817424, "uuid": "e8818962-af91-4439-ab92-26343ee430d1", "value": "12288:l9D+y2LTzqPXqvCn0RUmJVp60XoyGs11c1r68drHaWYHHRp6Dtp2kOMm:K3qPalu280XKAcN6Y1iRAZpn+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646817424, "uuid": "876996a3-292a-47a4-aa2c-a0414ded1a2d", "value": 690094, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646817424, "uuid": "786ef4fb-19ce-400c-a73a-6e55f3e5d746", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646817424, "uuid": "6653503b-e75d-45b1-8d89-be23303dc0b6", "value": "REQUEST FOR QUOTATION Q4 DECEMBER_SHIPMENT pdf.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e79dddd0-9fcf-11ec-9275-42010a9c0029", "comment": "Malware payload (Quakbot)", "timestamp": 1646847583, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646847583, "uuid": "9f1de1e1-9f24-4c5b-8172-ef563ed17281", "comment": "Malware payload (Quakbot)", "value": "03fee637671b15d29939ba94ca4d2939", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama164", "colour": "#6C68A0", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646847583, "uuid": "195a0bd8-c7b2-42df-9ea7-b22d18a55327", "comment": "Malware payload (Quakbot)", "value": "2038276cab6905cb3334825ca34e9417d520566b78f31e706336d092be8ccc7a", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama164", "colour": "#6C68A0", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646847583, "uuid": "5e243bbc-a3ac-4af3-a2c1-3c543292a7bd", "comment": "Malware payload (Quakbot)", "value": "44c066a95acf62f34ebb1df85e306b45c7bd9770", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama164", "colour": "#6C68A0", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646847583, "uuid": "ac18341c-52cd-47b1-aef6-329cd929fea2", "comment": "Malware payload (Quakbot)", "value": "28dfabfb353d71745d8790410e60575561edf1228f63ed336c6617219d9dbb8447e1304de57d0b892a3b199f50d6a71c", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama164", "colour": "#6C68A0", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646847583, "uuid": "9e31291c-8c4b-4377-8a61-76bc8873b92b", "value": "T137657E23F2C1887AD4761A3C9D1B739998BA79112D28F4C77AD44E8C1F37A433666393", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646847583, "uuid": "3ac02d6e-8a6a-495a-943b-f1c972b01014", "value": "cf78a88c4b0403a976a85038ec51a351", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646847583, "uuid": "92ef8143-2744-4d86-844b-c21cccc2f174", "value": "24576:LP2GXxd5hyXOZk/R8SoMbEYN54UUrW/tRJfJJOIU2SAHl4XoWSIgX4T:Lu8jI6kcYN9RJiKKgX4T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646847583, "uuid": "9b97f565-86aa-46bc-bddf-1ab780131c14", "value": 1502720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646847583, "uuid": "65983bea-5fb8-494f-ad7b-406833e0eb62", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646847583, "uuid": "39b6a5b2-dcd0-4418-98c3-6bd944a13b3f", "value": "3325249.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "960cc43b-9f80-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1646813516, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646813516, "uuid": "faee7fac-e04f-45e1-822a-965b0826b036", "comment": "Malware payload (Formbook)", "value": "66c4ff35650f6023c7ce07580436fc24", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646813516, "uuid": "ca013e0f-528d-45e1-8839-255c2901d6f5", "comment": "Malware payload (Formbook)", "value": "20c619b24631b9100eb49b1468b409f6e240146d5ef21b82b7bb96777e20979f", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646813516, "uuid": "70af6100-9760-4e58-927e-b6bb47cd9841", "comment": "Malware payload (Formbook)", "value": "77edfe5ae45f6c6e0f69a506488a68b45ae0c9ae", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646813516, "uuid": "a54f9575-13a1-4f43-98e9-8dceb3b50840", "comment": "Malware payload (Formbook)", "value": "7719709a7020bccce005d1ddf36fbb3eea41cbeb3cc7aa09c26aeec43c38d0d2acfdb6a52b0491134dcf3f28b6fefbc6", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646813516, "uuid": "48ed31e0-f3ef-45ee-8a7e-70a47be29a72", "value": "T165842353D9251D9C588BFFF8F3B5D58333D86608A5AFC03792983A56722D00A3B1E687", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646813516, "uuid": "5c620bde-01cc-4116-a7b2-b749f1d12777", "value": "6144:cmBL7OTKBghfIW1pEzc0Id40kfAdOt5zGNmcUnKfR5effSgttl8SHd4E5N+Z1OfG:csHOTFRIW1pEzcLOpGN+gR5efKgtH40g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646813516, "uuid": "efd8ee85-e901-4481-af69-394bd1261b40", "value": 373250, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646813516, "uuid": "e7103828-2d27-4a4c-8c31-95b25cee3941", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646813516, "uuid": "c48b4c21-3e6b-4914-a5eb-289345f7a253", "value": "SCANNED CUSTOM DECLARATION.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf9ed0fe-9fba-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1646838523, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646838523, "uuid": "db3ef313-47a3-46ec-a3db-96c5a39b9eda", "comment": "Malware payload (Loki)", "value": "0f74595c1dbd0d14d35e10c29c14d20b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646838523, "uuid": "1c581b37-564c-4850-a13c-f196cfef57bf", "comment": "Malware payload (Loki)", "value": "215f374bc14e1433f6dfd2d129081fabf2cb7d0507d83ce09673869076a461a7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646838523, "uuid": "00fa161e-b1f9-4fd7-810e-11ecf20b5072", "comment": "Malware payload (Loki)", "value": "01eab6e2a6b75ccc24786074fc3c31d165a4c5d2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646838523, "uuid": "23117828-bf34-404d-86c9-9d929fb56d6c", "comment": "Malware payload (Loki)", "value": "dec21c540aebb1a5b18fa3987cf32dca9560cdab23915e75c9625ff52d99624bbe06e0e3016eb8e3e3955863c4e28783", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646838523, "uuid": "7c413f40-c436-4b53-a6c0-4fd609d1d053", "value": "T1A6A42771A0F16AC9F8D68EB29E60E65AFFE70D818950461FD23439F61233B84C6451FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646838523, "uuid": "66557ea4-5c65-4889-ace0-4889708f4a69", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646838523, "uuid": "e099a1f1-bd96-446e-89da-e8b2d2cb9e54", "value": "6144:QGiVa+daNUIKV/zFB+lEzIMsoq4mdD80Tv4Nj+i5yLJDc0uq1:aANUIKhnhV2tdYTUWyL1c0uq1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646838523, "uuid": "a3657a25-2939-4eb5-a568-1d63f43f25a3", "value": 480354, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646838523, "uuid": "f23129b9-c8f5-4a9f-b9c1-3dd4616abe75", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646838523, "uuid": "86b90550-aeac-419b-8643-dc8c0b7c14e3", "value": "PO #11325221022_pdf__________________.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9440062-9f7e-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1646812770, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646812770, "uuid": "50bd28fe-aa07-4164-a586-3bed812b7b35", "comment": "Malware payload (AgentTesla)", "value": "ca94d131a97f0551b7c9a36921237f73", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646812770, "uuid": "3dfd9f9d-d48d-4625-9b5f-ba17746849a7", "comment": "Malware payload (AgentTesla)", "value": "218259b54077a406d5d888f8030e3499d2f502da5562bdcaf51c2d932f718804", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646812770, "uuid": "d2fb43f7-3cc3-4221-b5a6-58fd02b5b67d", "comment": "Malware payload (AgentTesla)", "value": "f5d3503e533c682cbb88b4ffe76d5daf37f3b134", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646812770, "uuid": "5ce8aaff-7389-447f-9a87-ae615dfb6266", "comment": "Malware payload (AgentTesla)", "value": "f499269a35ab192d30e9568afa7f57cc635391a67ba19d77c6b53d3523e316424b0c47a4a3a77f44093f1305337a621d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646812770, "uuid": "e0e04de0-635a-4a26-9d44-30f13c7f2e3f", "value": "T150D2F1364732D9ACF052D682E38886003726B1D856B1892F5B7B9CFE1F89510C7CFE56", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646812770, "uuid": "7562d669-faed-4608-9639-8a37beedf694", "value": "768:TyokXxUVrnyr4Ek1dBxzINOoSSFS2GNywSER/gWi:TylxUVrnE471DxcNOoSqKNywSER/+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646812770, "uuid": "2486e9f9-7784-4293-9904-391b00c340af", "value": 28359, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646812770, "uuid": "83e8d050-9bfa-4ec5-9820-fa60ed50d4f7", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646812770, "uuid": "d529ec04-7d00-4287-b4fd-52aeda27b725", "value": "SHIPPING DOCUMENT.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5371d8ad-9f84-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646815122, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646815122, "uuid": "729d4213-0706-43c6-9753-eb2cbffc5e21", "comment": "Malware payload", "value": "0b5844677883b926505b6b13ef3b1f5a", "object_relation": "md5", "Tag": [ { "name": "NimbleMamba", "colour": "#B0B1E3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646815122, "uuid": "30aef5bd-19c0-4aa4-94f4-9c7bf70cc34f", "comment": "Malware payload", "value": "21a2cf315fbacc1ea7a65aa047ac3218c27486d035dc51e19e3a888cdc7a0d48", "object_relation": "sha256", "Tag": [ { "name": "NimbleMamba", "colour": "#B0B1E3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646815122, "uuid": "2bf41dff-681b-4512-ae74-429f1be2de19", "comment": "Malware payload", "value": "e587635f02565c80897e446a0d318816f5bb58b6", "object_relation": "sha1", "Tag": [ { "name": "NimbleMamba", "colour": "#B0B1E3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646815122, "uuid": "fcfcc345-7d5f-4d6e-8b2d-00b64b7c51a7", "comment": "Malware payload", "value": "d8ce344a308cb47f87c36a442fadc7f6cd286ac44791ace9242206d40087e414875fce836471209d31fdc9145c948a25", "object_relation": "sha3-384", "Tag": [ { "name": "NimbleMamba", "colour": "#B0B1E3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646815122, "uuid": "d5e4cf28-6b5d-4f80-b8e1-62dbe7f6ac57", "value": "T1CAD4234F53A80F9221B1372F1985DA5FB9C434AA8749DE699D00B32F39DAC5C90E7372", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646815122, "uuid": "8b78e7f7-9fa8-4396-91f8-5ea92e1b782b", "value": "12288:pTlNuIxTvKs+m3/lJf5DHYFZ8Vi8YUWKJFp9KcR3m+WZQNnosP:Jv5BCs+293YoV/YU5FpXm+Zl3P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646815122, "uuid": "306cadde-c6f6-46cf-a262-88c5c6af820f", "value": 634674, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646815122, "uuid": "5fd6b140-d9b3-4bc7-af8a-d14baa87e013", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646815122, "uuid": "961cb7f6-ba8d-47d7-ba4d-ebc55f926913", "value": "82ab9750-fe8b-499c-55cd-3faea83dc76b.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e74570fa-9f8c-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1646818806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646818806, "uuid": "0d9c2c7f-8406-49bc-add8-432907b1bae4", "comment": "Malware payload (AgentTesla)", "value": "ce43c12162b6c011cfa3f2c2bad9f641", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646818806, "uuid": "4dbec53f-9d93-4658-8b7c-57b6aa7b521a", "comment": "Malware payload (AgentTesla)", "value": "2210d1f3b152858bd86fc559caf22d32a9d93e9447711aebb4d2a512db9bddcf", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646818806, "uuid": "95ceefdf-c705-4190-8dbf-db0233e30053", "comment": "Malware payload (AgentTesla)", "value": "7074d5df95431f0d6b8ea8917fa4e6888aae63dc", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646818806, "uuid": "023c08b0-cdca-49e1-995c-aa0fcce102a5", "comment": "Malware payload (AgentTesla)", "value": "d7bd60917990d817a225aee59f33e9e0c5a3885bba04bd86f8727e1fc034af92b9c0be05f908f57f0be86ede7ebb2d3d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646818806, "uuid": "29fa46e6-f540-4a2b-8de7-8a9496c02bb7", "value": "T10BE433E44F4F4120D14BDABAD3DA972650D465794624EF9033E830FEAEB1B8035AB2C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646818806, "uuid": "3c02927c-917c-40bc-b1b8-7e5dcc52767b", "value": "12288:fxW3FuNrZTaeNzUmjNQYMsbhC/ZrckOwZxpokKnhQY8wCdgtS:JW36FLLHbh8ZcFwZHokKnhQY4CS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646818806, "uuid": "c3afb486-563c-4b03-b9f3-7199c319dc9c", "value": 664539, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646818806, "uuid": "41b7395d-f58e-488b-b166-b0ce393666cc", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646818806, "uuid": "9411b7eb-c01c-4ff4-a09f-9fb11624f155", "value": "Overdue Payment.pdf.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "559ebc8d-9fd1-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1646848197, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646848197, "uuid": "ed7840c0-6019-4b48-9a11-cf30a04ac65c", "comment": "Malware payload (Mirai)", "value": "dc65702bcbe027c55dba6af9ba35f6dc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646848197, "uuid": "027d3b1a-c21d-4bd2-9d52-5661179ed960", "comment": "Malware payload (Mirai)", "value": "22bdadfc642fdb1dd939acc24e6a97eccf459cd3ff43d9331e97bde71691f6f5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646848197, "uuid": "99445108-3fe7-4378-ac34-e13e6cb208f1", "comment": "Malware payload (Mirai)", "value": "63fe08c5a2c0589819975f4f608fb7d87515ae3c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646848197, "uuid": "e15cdfaf-dc1e-4181-9c6f-01a3a015b368", "comment": "Malware payload (Mirai)", "value": "0e11c3c75d0d594336b3e11601de5813f5130b79cc84944d85ce43baf3da4506d687a6ce7123aa95cc48189c130ddceb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646848197, "uuid": "e97644fa-f7ea-4b90-94f1-4c0a2c36291c", "value": "T190539E63C4641DA4C1544AB0B9288FB61763E60087637FF5426ACBA99057EFCF60E3F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646848197, "uuid": "61a043e2-2772-4b0f-9083-055c2664d922", "value": "1536:oagv1AOp/umClcqseYyYGsYh4GSijKmR7GrxhCKkdV8:ox11KmqsrI4xiGm2xhKV8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646848197, "uuid": "b16f97da-16c8-46a0-b23d-d91380182a29", "value": 62592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646848197, "uuid": "63c66768-1134-4bb8-aeed-f0f94d50754f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646848197, "uuid": "f3a8ef00-3297-4417-9414-405df25ab07d", "value": "dc65702bcbe027c55dba6af9ba35f6dc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e48ed287-9f86-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646816225, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646816225, "uuid": "37b26169-2d17-4d4d-b2fa-d4ff4315df14", "comment": "Malware payload", "value": "69d6142ed71e39b20eb958f410b1cb15", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646816225, "uuid": "73202b06-da6a-4a8b-b358-690d2a2695d3", "comment": "Malware payload", "value": "22cddbf410de6b9eccb6ab8590dbf9750fc4667e6b84aa49871544da6569daea", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646816225, "uuid": "01ba963d-b070-4fce-bc03-c4a9172dcec8", "comment": "Malware payload", "value": "9171ef3eaaaedd856475877d0c0f60b276ac5bfa", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646816225, "uuid": "027500d4-e50e-42fd-ad43-bb1e2728629a", "comment": "Malware payload", "value": "224d0799b8538cb5efbd97e9025dad5f1343985b1ff6e7137c35608a1e81586bee915f3536769b980a7675f5e61a7f5e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646816225, "uuid": "343afcba-2650-40cd-bcd1-d8c633c32f86", "value": "T12B84238891CBDC503335BC6E0F5BFBD939C89F8E5A05FE6A022DD5E0266A8597402CE4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646816225, "uuid": "2a6fd840-0a2b-431a-8213-5414df0e70de", "value": "6144:DlfBEWTg+RW8NnjMXdmhtF/6WLFq8188A+BiqcDZ6psVC/oj2cKS3m34bJSN7+sD:BfBTTgXdM76WpqoViqj/ojFKFVo5iCW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646816225, "uuid": "fab9ef37-3863-4b55-b974-9a7bbced37a9", "value": 403576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646816225, "uuid": "cc065af5-5dfe-43aa-be44-75605149329a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646816225, "uuid": "894790da-a2c3-43b3-aa2b-008e38dccea7", "value": "SOA.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fc96c75-a003-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646869796, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646869796, "uuid": "5a2a5c9c-18aa-42e7-8a6a-73f036e57e6a", "comment": "Malware payload", "value": "93a3a8ce440197d31168fac569082937", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646869796, "uuid": "41f2decc-6fbe-4185-a370-18b0d6897e67", "comment": "Malware payload", "value": "22ef521964080e77d7006f9341d720683fa98409361c62a7bc4fe81ec474b1b2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646869796, "uuid": "425faf62-c393-4d61-bab5-a7fb9b196b99", "comment": "Malware payload", "value": "fad3066803a1ba8f9cb8bb7d1969eea0398b5ea0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646869796, "uuid": "070185e5-ca8a-46bd-b86a-34093dc53324", "comment": "Malware payload", "value": "843ee7b70e8a474a05acb8cf11fa83fa0688c9cf4bacc15d2615cb6504498a0d40f56a9b8283f97b9c1443a7e585f883", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646869796, "uuid": "fe725ce5-4667-446f-bf08-b3bfdefbe2e6", "value": "T1C796AF213AE98276E15216308DE96FF1A1F5FE1C0F21849733987F1D3E769D08639B1A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646869796, "uuid": "acc93e80-06e7-4473-a7e4-e401480aa8b0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646869796, "uuid": "803ba9ff-7039-4134-82bc-a2709cd8baa2", "value": "196608:OkwywCAfywOwe+ZCcyw3ywsyw3ywZywcywZywBywEyw4ywwywmIBywyywsywcywy:3wCAqwU+ZowiwxwiwUwBwUw8wJwVwtwF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646869796, "uuid": "771ffc99-0526-40f8-ac9e-a20a7c7c89a6", "value": 8987424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646869796, "uuid": "741baa9f-3de2-4de2-af2b-44ad468853c8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646869796, "uuid": "a33e79c5-b275-4930-9cef-3ca28d4a6cc9", "value": "KMSAuto Net 1.5.1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9951834-9fb7-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646837171, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646837171, "uuid": "04023e1a-18f3-4cee-b757-33f7338f7132", "comment": "Malware payload", "value": "40311b5b5937683dd3cd4c4d4338782f", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646837171, "uuid": "982b0a75-ed8a-4e4e-8a78-b02b70b9db72", "comment": "Malware payload", "value": "239f19be1a6886028e319efa52b155efac9fca383cce96bd063761d9b2ed5dea", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646837171, "uuid": "15c3c2b9-23d0-445c-baf1-21533c68114d", "comment": "Malware payload", "value": "5545188a310277e690e95b2e2547660900cf70f8", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646837171, "uuid": "9a741bc1-21b5-4da1-804d-4bb54a566aba", "comment": "Malware payload", "value": "42cf138f7cbe46f0d3842badba0683efda9188cbf283fae8cc4ede6009742929951ef927e3dceacd5e81bc0eabd277ee", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646837171, "uuid": "81b33401-3b15-48b4-8aa9-38f725de4bfd", "value": "T1AD92C0ADC915F824E39A89FD186C47FEF61CC26596809E0F1000F21E5A504DB8F8FDDA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646837171, "uuid": "bf2e4f2e-6fbb-498d-9fbe-9a5630696a3e", "value": "384:JfKXZTH0ylHcaRvIUx1EoS7t4jd7gXXbRuXXsuoQlJ/9NciR8a/:WZTH0uNJ9xyvZ4jd0oroQP3cK8M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646837171, "uuid": "5606c3f2-a219-4068-bd7a-f831d03a82d1", "value": 20528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646837171, "uuid": "b5c357d5-d078-411c-9552-6c6a2349bb00", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646837171, "uuid": "a1339712-bd4f-4ade-a4b2-2fdbbec235e0", "value": "jacob.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ac4c3a0-9f9f-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646826704, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646826704, "uuid": "3c9f96b4-4b07-4c0f-80e8-a0cacd0fcc1c", "comment": "Malware payload", "value": "11660d7539ec02ee272a2a66158ead65", "object_relation": "md5", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646826704, "uuid": "41596383-f270-43ba-a827-0d8dd271ec07", "comment": "Malware payload", "value": "2430ab1a8b5c4c36c66271987d5759ac50272bd98fa6d3ba9d0d2863e27c242d", "object_relation": "sha256", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646826704, "uuid": "1c49f834-6b09-4000-b553-530e4adc9fb6", "comment": "Malware payload", "value": "0da8080e92ead020db27e9db3346e8052b99850d", "object_relation": "sha1", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646826704, "uuid": "ce10b386-292d-46cc-87c2-9241de385f6c", "comment": "Malware payload", "value": "f31b77bc110945cbf518a9484be37ddb00741d35e6dabb4b0828897423fdcaa24214d013f99ebd6270556b90ec0a86c5", "object_relation": "sha3-384", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646826704, "uuid": "0f158106-0284-46fc-9307-9496c3b8d00f", "value": "T1E814F8617BE8D23AEABA0B311D732240073AF381D967DF6E548C645B6D323454AF2B71", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646826704, "uuid": "742d1baf-dd21-427b-ad55-36c3e6bd3ff8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646826704, "uuid": "faa42b00-aa93-4b99-bbb1-c2d147987915", "value": "96:lQclG3ViIUWpw0uRPIXH7Ruun+v4zMde7J0wxrp0fhSVLc6t6qnsMKaUzNt:q7UWpZXbRnnzUeiwxWfqcvMK9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646826704, "uuid": "a9245d5f-1ebe-4804-a902-c522dbb3bab3", "value": 208704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646826704, "uuid": "80a4f95c-7edc-4ee2-ae3f-0d7746587582", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646826704, "uuid": "0a7e7036-459b-41a0-a170-ba1ab3466403", "value": "ConsoleApp.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da14a092-9faf-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1646833816, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646833816, "uuid": "5c0c223a-256f-42a8-bd25-eea29f1925f1", "comment": "Malware payload (AgentTesla)", "value": "3df719d167b87b2dfdc6d76785bdae5e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646833816, "uuid": "3962de4d-4542-445f-a572-f1b0c3eb4d89", "comment": "Malware payload (AgentTesla)", "value": "2446309f61a8f555341050a21d23ae03fffada95dfaa88ccae812ba306e3dfcc", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646833816, "uuid": "65e589c5-db15-42a8-93f5-34b359bf9f61", "comment": "Malware payload (AgentTesla)", "value": "ec892dd72979336a37c5389cbf67086ed63a6125", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646833816, "uuid": "1c1092b6-c151-4603-9a1b-08917c6d6509", "comment": "Malware payload (AgentTesla)", "value": "c2794cbb29ebd794814e43f2ff6d5a2833bd9682a649bbd65a2a86a66d79d0dd89d411ac114c9503908063abe58fe64b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646833816, "uuid": "a223fc81-8a97-47d4-8aa7-5172867489cb", "value": "T1FDE423055EAD74FBE6A63F25B3959E87B1832E834BC13285E7668D50C6C37C8DEC8610", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646833816, "uuid": "92af2365-773e-4af3-af7e-76780b0263d1", "value": "12288:v/X0HtGUgr8aINGGddoMLLGGe9Dzu9CtfeQFTgon28UlP/TpKnzWL:v/3Ug8aTGXvGRlmCtfzFTM/TpOWL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646833816, "uuid": "760f0621-09fc-4821-9cf5-14b613f060a5", "value": 670812, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646833816, "uuid": "30989924-db82-4474-ab89-750af1ff45bd", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646833816, "uuid": "ae90a2ba-be65-46d1-9d2a-6a42e9eb7e02", "value": "SOA.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d8ab951-9fe5-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1646856827, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646856827, "uuid": "05e06dd1-d488-4ee0-94e1-3d87e38db3b7", "comment": "Malware payload (RedLineStealer)", "value": "4d15a440b1752e4e19a1959e305866d1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646856827, "uuid": "48f23495-cb69-46a7-af43-0ad038f191d8", "comment": "Malware payload (RedLineStealer)", "value": "246beeae8f95d67c62e15fb2a16b270f75fe2beb83a6d680aa4c81dc89aed8a1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646856827, "uuid": "8af4da46-4542-49c2-b781-b3aaad36f5c0", "comment": "Malware payload (RedLineStealer)", "value": "09fa7127d05e05cd41b4f72421e586f0ee209a02", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646856827, "uuid": "7a4faa8d-a4a0-4450-8480-438de99f13c3", "comment": "Malware payload (RedLineStealer)", "value": "dde05d1e5d25560e76e6d1aa65db8f5840c9eb75d46b161e3bf03fc357bb16a1f25a14db7ba5634b58b63c340f7fd9cd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646856827, "uuid": "ee490993-c3c9-4153-8a8e-a8dbd9bea9f4", "value": "T121C423E3735FD3A8D05E9F755D207ACE96CEC05528983007D39A1DA24478A8BE61C8BD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646856827, "uuid": "c31a708c-c7d6-4552-8a69-d8e941896b26", "value": "445554923421947cbff896012e27345a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646856827, "uuid": "4261d14c-45fc-4124-9cad-4ae6ba8e8896", "value": "12288:e8f45TQ6fB0PEtVe2PXGv40nmCQS03ULaHNqrxlKIQNo5TC+K5DyoxjFrHw:tf45T5B//e2e/mCkEaHNYK3H+K5DyoxW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646856827, "uuid": "aa3c4f86-dbd3-4106-a2f5-b8d5df3d8d06", "value": 569344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646856827, "uuid": "95121aae-6ae4-4f3b-9e86-65c0ee022397", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646856827, "uuid": "60a42920-503e-4404-af73-c3580af0f4db", "value": "4d15a440b1752e4e19a1959e305866d1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ff4f872-9fd1-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646848107, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646848107, "uuid": "7ff7c922-f0e7-4b28-9c48-719d40a0a2f8", "comment": "Malware payload", "value": "ea907f8ccf681df19560cd492408d0d4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646848107, "uuid": "29a84bfd-7b5e-4503-b79c-26521d7c916a", "comment": "Malware payload", "value": "24efea9b3011f267bdfd19976c7de810749dad63ab4191cf9b1550eb58c065d7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646848107, "uuid": "f5b0aa13-fe59-4f90-92ab-e8ee24cd412d", "comment": "Malware payload", "value": "ab1ab0002dc1edf05651fda2d52900d98a39987b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646848107, "uuid": "a2d44357-7877-41b1-b23f-c4f34b7446ef", "comment": "Malware payload", "value": "eb42e91f6c578e4d5d63b1a6c92f67665285babe9db45a7efe2f5c9ce1a6ed52f34f57715336be165ea59e6ee339351d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646848107, "uuid": "66f6dc36-4885-4eb8-9d60-d41181833d5c", "value": "T1AA721A06A7D48231DA7E0B7678A2425A9B72E6274827CB7E3C9C905B3F7730543137E6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646848107, "uuid": "c732b5b9-c731-492a-973e-1cbbe2c87d1b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646848107, "uuid": "8fcb869f-3a2b-4bb4-8651-a73c00f73fc8", "value": "384:u5zZIzXvqyrwjSSiDaYNdjj0Cd1SfaJKVfI4ptYcFwVc03K:uHYNtDaYNZj9K3astYcFwVc6K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646848107, "uuid": "ee176902-8e2e-4c11-98d7-1dd43decf9af", "value": 16896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646848107, "uuid": "376a07ef-b415-4cee-bd16-cde1008a702b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646848107, "uuid": "f4a21748-7c50-47f8-b9f3-a22ee9e10e87", "value": "Kittyez.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa592977-9ff2-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646862647, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646862647, "uuid": "1a566f63-2a6c-48b7-88c2-2dd48f1a948b", "comment": "Malware payload", "value": "0d80e954053de82980de0aa062f56540", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646862647, "uuid": "e29b4d7e-76a3-4fd3-9778-8cada73c056a", "comment": "Malware payload", "value": "25b56387d774c9b1e0029ae970935cb5c034ce17f544974f8415e54baf900427", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646862647, "uuid": "414aa2f2-72ac-4573-a9be-5dd91b71b514", "comment": "Malware payload", "value": "0ceecfd3bb193127427fdb4501cd8613a8829173", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646862647, "uuid": "f565c7f8-8389-4184-87fc-d996b864521f", "comment": "Malware payload", "value": "90f80ea92a907af2292ce3dcdf916a8627c7d6a3bd755146d20d905fcdcdf171fb87cf7afe3fbf61f682abe75b147fa2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646862647, "uuid": "51170ded-9b87-46ec-9c3f-ba28845a0dee", "value": "T1D93633694FC92818CDB17DB2015761B7B94721FCA1F0E1E63821E1DEAD8C0AC3757AE9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646862647, "uuid": "d15e3ac2-0ec8-402b-b5dc-a7ca3bb0552c", "value": "fddc083fa31a17c938d0a17ec7cd3025", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646862647, "uuid": "19b240ed-f74d-4e94-a0d2-0eef486720c5", "value": "98304:c3thJWxiETZG/S9/5cFa1rUZfZo+ZVDYa/Qxj3rxhsOjBqm2svwofKtJBs/GwP:c9uBZG/o/5cQBUZf62EjPsEKqyBs/J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646862647, "uuid": "9b15fd68-2dbc-4dec-b19b-b5db712261d7", "value": 4898816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646862647, "uuid": "392ddc16-57c2-4dcc-985e-46ed84def0f6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646862647, "uuid": "19d95c5a-00b1-423b-af11-15f912daf1ab", "value": "SecuriteInfo.com.Trojan.GenericKD.38986915.12724.24777", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aad9bf88-9fc1-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1646841468, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646841468, "uuid": "f8dc1a4d-cc6d-4fcb-afa5-a8860a83c488", "comment": "Malware payload (Mirai)", "value": "71b9cfdb68403e0c365a789dbffb0027", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646841468, "uuid": "dd0e597a-9a08-4303-b32f-4be01122eb46", "comment": "Malware payload (Mirai)", "value": "25e36922f6f13c88df32ddb7096b34d1e531589e88414894ab5011b381620914", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646841468, "uuid": "0b015525-92fa-4db5-ba40-da238281b7dd", "comment": "Malware payload (Mirai)", "value": "c1b67e27b612426be6205b99a98b753344c4a90e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646841468, "uuid": "2bbb1c64-47e6-40f3-8abf-16ea08b8ffa8", "comment": "Malware payload (Mirai)", "value": "456a409c35c3042174228598232110db460a09e41f4638a994aa98812e6a453094617c2b440de156e96312d25041cc25", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646841468, "uuid": "9b83883b-a2e6-47d8-9d80-0415693fb813", "value": "T109638209BF611FF7EC6FDC374AE91B4525DD641A21A83B397930E818F24A24B19E3874", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646841468, "uuid": "799323cc-a30a-466f-ae71-c3dd58e2afa6", "value": "768:CDScD5GY2naf8i2Sxt9yYExR15III5vTemle5Re5bbvuH5XiANe1j9YE:CDSC5G9afb249FK5I5fl8RWbriq1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646841468, "uuid": "4086d618-413e-414a-a732-74f785790d0a", "value": 71568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646841468, "uuid": "c7e34300-ca5e-4813-a774-14dabd1e7f42", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646841468, "uuid": "e3c9b9ff-794a-4464-8338-209ff2c7987e", "value": "71b9cfdb68403e0c365a789dbffb0027", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ebef09a-9fe7-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646857634, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646857634, "uuid": "cc55cabb-250c-415c-b86d-edf83bd5e030", "comment": "Malware payload", "value": "99f9c2a4b138a17ef3f955fbe400edab", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646857634, "uuid": "4fe9829b-6bbb-4b9f-bca0-10735da9482a", "comment": "Malware payload", "value": "2647fc2ae03e2c42463ef30e9165c2d22d7a5f5c09e9e3c768a252c59fdc7b78", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646857634, "uuid": "a539d84b-8865-446c-bf14-68a626cc83c8", "comment": "Malware payload", "value": "56da4619f723777dde9a20f110b28696099d6e9a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646857634, "uuid": "44e2d612-6330-44aa-b4fa-37b9dac7c3d8", "comment": "Malware payload", "value": "671108199aec00cd6934ca9886767e2c01f642335316417c01b665d98b4111f447d8c3ec86b19f435a065cc162585b13", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646857634, "uuid": "a5a5f952-c5f2-407a-b240-b35f314bba85", "value": "T11D643D4A7B4D621FC3372A784686D44BD664FD5E3A66CE13FE4C322C3B336936841686", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646857634, "uuid": "eac43f23-01d9-4fa6-84bc-29f0e6bca68c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646857634, "uuid": "7f08605c-576c-4ccf-8ab6-c632bca57f20", "value": "768:6d8dnCm4gJrWxH4SeSEDxk87SDH7W2E5Z+P0WxJZfKBtV7VVV67VVVnVVV8VVVz5:i8dCAWxH4SADm87LH/m0kJkBYu5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646857634, "uuid": "2fca3eda-d88f-4eea-9925-e29cd0560e2f", "value": 322560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646857634, "uuid": "050cd3af-ec81-40e3-8527-73afa0b9f541", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646857634, "uuid": "5cf943e2-b27f-4ab5-832c-72d7ff16c487", "value": "99f9c2a4b138a17ef3f955fbe400edab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13b7932c-9ff1-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646861830, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646861830, "uuid": "cbd697a0-093e-404e-b953-d78e05d5a65f", "comment": "Malware payload", "value": "c6933fb0ead86575fe08ea29d166d2c6", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646861830, "uuid": "c9f47f7d-63e0-412e-8c23-d46479ba3651", "comment": "Malware payload", "value": "2649a6048bb17856c0dcb71ebdecb95c9c71d91c7cde49996b721c092244dc17", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646861830, "uuid": "2958a2af-37d7-47c0-9f02-7d8a3740a3b8", "comment": "Malware payload", "value": "18263613c2f36c4c6744a594b33763fde737a1e2", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646861830, "uuid": "5e5011c0-074b-4c25-b5c3-bc80ce5a9d96", "comment": "Malware payload", "value": "98ab095500cc6a26334d8e6d381b63619972101bb07c7c570529dc6405670366bf7a5f862e48f1d5dd05829258a2d85f", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646861830, "uuid": "38fe0db1-394e-45d7-bf91-4979a3f3b275", "value": "T1FE156D113781C037C11B3C3286AE937E62EA9A314FA5E6875F9475BD8E345C2DA3DB06", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646861830, "uuid": "b09dca4e-9893-4bd0-891d-b1ce8778e8ef", "value": "a517173f90c43414bccc160c37653529", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646861830, "uuid": "2c57b738-4cba-4ad6-a4b3-1fff923c7cb3", "value": "12288:4mZ2fbGh8Nggu3uTkIKD56pInvq0fPJ7/2fdwVW4SiPje88koKiaCx:4Bu3uT5KUpInvPfodwVW4Sif8kiaCx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646861830, "uuid": "a3c6685e-84f8-4e1e-98c6-69e9c3f68bc4", "value": 956416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646861830, "uuid": "4bf685d8-5201-48df-aadf-24ca1e1e0c7b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646861830, "uuid": "d7fe72c6-8cb1-45b2-8984-3d6c516ee16f", "value": "emotet_exe_e5_2649a6048bb17856c0dcb71ebdecb95c9c71d91c7cde49996b721c092244dc17_2022-03-09__213703.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b061028e-9f85-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1646815708, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646815708, "uuid": "275e54e2-5392-4e8a-a1b0-e4bdd5e8f2d5", "comment": "Malware payload (AgentTesla)", "value": "e5e835e3a173a1cf23569e195000c138", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646815708, "uuid": "ae4658b6-925a-4add-b2b4-3d1c5f86c2d9", "comment": "Malware payload (AgentTesla)", "value": "26bf5afe027addaa52d2cf2fb1472da70c5cf2eaf2d8a9a34d32d0605405034b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646815708, "uuid": "4b5c3822-5f90-40f8-8c18-ccb38e3bb8f1", "comment": "Malware payload (AgentTesla)", "value": "38aa7e55f77537d20b310b3f9bc13918f3e51b22", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646815708, "uuid": "877d934f-1a52-4b7d-bf4b-f0658e4d9875", "comment": "Malware payload (AgentTesla)", "value": "54e6b8d0f1c79cdd81f26a44ca894b897fac251ce97e000ae3eee6db43fa148086436e58a81bbf7de5cfb3369af0cb0c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646815708, "uuid": "d360d36e-1264-4fbf-9159-612faae8ce40", "value": "T1B5F4C59C316031DEC96BD6719AA81E68FFA03C77831F511B902731AD9A3D987CF245B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646815708, "uuid": "e66c3551-e113-4173-b739-b9ea882a6f19", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646815708, "uuid": "1211a490-f069-44cd-b19a-3f4fe327d36f", "value": "12288:dX8c8xX4r63PA7fbF98LJED8t8PU7bac6nFlOTJLaelcw5HMgCQnYdn5LMY/w69b:dn85gDX2SNU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646815708, "uuid": "c5e18d3b-aa19-4340-9cf0-2ef2db83859f", "value": 754688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646815708, "uuid": "b82961ce-65f1-49da-ba3f-564129fa0e69", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646815708, "uuid": "4c745edb-63e6-4b5a-91cd-dff180db0709", "value": "PURCHASE ORDER.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad99a232-9fc1-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646841473, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646841473, "uuid": "54c1687f-3674-43d2-b12a-96dea190dde1", "comment": "Malware payload (Heodo)", "value": "2daa898e871fe2c52cc2a29976dcbe0f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646841473, "uuid": "bbe72989-81f3-4460-ab8f-91cf50908e07", "comment": "Malware payload (Heodo)", "value": "27cb3eafca031cd3a049de4270011568ed2228d633fe3f8e8b73cb365b7c4822", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646841473, "uuid": "9b09293d-59ba-45d3-9a3f-26d408fc5b78", "comment": "Malware payload (Heodo)", "value": "1905e86268a6f03e3358bfadf3c93667c898f280", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646841473, "uuid": "94e76a65-0435-48de-a834-09fdeab551cd", "comment": "Malware payload (Heodo)", "value": "b2bb70de41cb20025eca3de476317ca29b37573735fabc72c9588b6e1be5e804652c876833aa109f1e4cb3ffb70d183c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646841473, "uuid": "d8786330-76e5-4d3d-b0f8-eb8c2747b693", "value": "T1B7257C107E8A817EC71B85B30836676D6FFEAB204B6CA1CB478175ED2D316C29B36705", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646841473, "uuid": "bf773f17-f537-4561-9255-823b199510bc", "value": "087c9809507dfca4c3283e6c7539e91c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646841473, "uuid": "24e816ee-7f91-4033-aa61-acb56e079d85", "value": "12288:cR5SOyRHiA6m0OcElazt6JtcS1j2xKkr:cR5SOrKlazEtcK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646841473, "uuid": "05698f38-c274-42d4-9d46-deeba1262ae2", "value": 1040384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646841473, "uuid": "361fb24f-a270-4238-b9db-8c9ad0522317", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646841473, "uuid": "d3cc05e8-5b34-4db7-9bbb-04a3ae2dbdb3", "value": "2daa898e871fe2c52cc2a29976dcbe0f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aefb3d06-9fbc-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1646839328, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646839328, "uuid": "11da40ff-f08f-48b4-a101-9332b9c227a5", "comment": "Malware payload (AgentTesla)", "value": "5455e04f5ba8e01709d01a073f798bf3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646839328, "uuid": "a3af5532-4864-4ba0-8a23-707b33c65979", "comment": "Malware payload (AgentTesla)", "value": "27f64fac371bf37c0389f98f96be430ad7cf4ca2c8fff87160aecb3184e528d7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646839328, "uuid": "e0a91586-7bb5-4490-9d5c-c6c0148a1266", "comment": "Malware payload (AgentTesla)", "value": "c859ab2f2ae2e46c70da48906331413b77b9d6f8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646839328, "uuid": "b2ec6c1c-83b5-4a88-88f0-9efedbf97dca", "comment": "Malware payload (AgentTesla)", "value": "3be71409420ae3684cb3b8703314c1af23cb02cddb27081612557b6bc725a2fc69c02a1364f51907c5287f1842609a12", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646839328, "uuid": "22dd3f04-1b30-46be-941b-bc0f6a7d4fc5", "value": "T11535AEE629EB401DF377AFB12FC8F8CE996AEA73151A30DB11520B768523A40CD61735", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646839328, "uuid": "59612bf9-5db3-4a27-9db8-d0b3360a0a5d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646839328, "uuid": "6f5170df-6db0-4ff5-a7b2-4afe7267a5cd", "value": "24576:ZD5kJXp+/htIw/VnphXWFXuruw283VSVjvn8zNZY4Im:ZD5kBw5tIw/VnKFXuipZj/ENZY4J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646839328, "uuid": "643fa097-ab26-4960-b2c2-4c78a59bd631", "value": 1085440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646839328, "uuid": "1e0f3c3b-b926-40ba-9d5e-85656d8e328e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646839328, "uuid": "e3f9ed39-2f34-457e-a6b6-4ada613037c7", "value": "POCWI19150.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "855d18c1-9f9d-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1646825943, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646825943, "uuid": "33dbde61-3770-4171-be26-54e27cc0e2c5", "comment": "Malware payload (Formbook)", "value": "c9d3c32a30ae406858628cdeba77388f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646825943, "uuid": "e682d0a7-3809-4696-a693-114078cd13e1", "comment": "Malware payload (Formbook)", "value": "28e3234be953f10d94060c2d518093700c7aa025c61e5e8a834690ef504d1388", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646825943, "uuid": "c5cab940-ac93-4520-a894-f05d79fe2db4", "comment": "Malware payload (Formbook)", "value": "2c0ddbfbeeb96f8b57cf63ad4f562bffe2bd5c1f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646825943, "uuid": "83a18068-de38-487a-8239-262aac85b456", "comment": "Malware payload (Formbook)", "value": "52b77c24a23eeb5ceb60d8306de6106d27be8a9bbde04d39758437e2f7154b46f61ffe6f7f6ff654aa55f7a6cf1de6bd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646825943, "uuid": "12d4f861-1cb4-4726-9cb8-e3e52e4efee3", "value": "T191558D6C3F445A6ACE6A46B3C452602F2D297308F29EF7305A4DCB54BC53F26B85426F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646825943, "uuid": "3f2286d0-3f95-4de6-953b-611506d5f757", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646825943, "uuid": "e79c3c25-30f9-49c6-9de3-b27d95f0b29a", "value": "24576:5Tjd7iG+FBQjsu6Xf5wcRavlf5UMdXThFO3Bihj:h1dHYP8IqhM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646825943, "uuid": "c0cffe0d-c33d-4614-9580-cadb2455a96d", "value": 1348096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646825943, "uuid": "05c478cd-60b0-4ce5-9b22-97c848d5bbfc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646825943, "uuid": "1ff19f4f-d439-4104-9269-b717e69ada81", "value": "Milleniumbpc_pagamento.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51af0b52-9f89-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646817267, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646817267, "uuid": "d59f3be7-584c-41cd-ac0b-02ed9dc29b5c", "comment": "Malware payload", "value": "804a3a7aa4cd139788eab95510817fa7", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646817267, "uuid": "948eb3c0-ddf7-4f9d-9980-c4cca356d258", "comment": "Malware payload", "value": "28ee91abd2a0efefab3b2e95ffe2ffaecd7ca0cf2a5bc5bf56b6810ba32eafb4", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646817267, "uuid": "76930c0d-afac-4be9-8737-9af37df29d83", "comment": "Malware payload", "value": "7918560e24dd4de8cc5a09d85da610d89efd15a6", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646817267, "uuid": "564ba735-b7f6-4ad5-a4f1-ddef462a3575", "comment": "Malware payload", "value": "2ddf7672b8baf5802f47c93c0f8b329908490b663ff32c13d0fad4949b3a14886c8e3b3ef0d0029329a1d3c5ecde8098", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646817267, "uuid": "bc8612f4-8c88-4a93-b5c0-c01c26ea5416", "value": "T172659E1136D6C436D5BE01703E2ED76B156EBE200BB188EB63D81E2E1EB15C25632F67", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646817267, "uuid": "ff594c94-ccf5-4215-9d9e-42f2eb544aa0", "value": "24576:im1yyzQyz5io+HExGWUAyiqZfBqnGIQ5M6DLrVVdWXAN3IqMXSpS2SDTQuV+vJFj:im1rz5io+HGGWxyzVlrXVVdWXAN3I1X4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646817267, "uuid": "b114258b-53a8-4bf9-bdea-cab5e4e90af9", "value": 1452544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646817267, "uuid": "76d8131a-3c7a-4c05-9d38-f766e899144a", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646817267, "uuid": "d8536d54-90aa-4afd-bc5a-8ffd8648b41c", "value": "TF.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83076808-9f9d-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646825939, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646825939, "uuid": "1f4d9b17-961c-4650-b6bc-b4cd062b498f", "comment": "Malware payload", "value": "bccf30dc69c3039b257d6d33a116cf1b", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646825939, "uuid": "c153f8c7-4ab1-4e53-affb-24b307bc72e4", "comment": "Malware payload", "value": "2938e3a484d5e9d36a81dca99c247ebe8b461011a7e7d72cbd5144697480b713", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646825939, "uuid": "c1013b63-6f5a-467a-b86e-a643238526e6", "comment": "Malware payload", "value": "0aea79ea0d1b6b9bab9e6653009b77a413735f11", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646825939, "uuid": "dcbb3c4a-1570-40ba-928e-76eb68273be3", "comment": "Malware payload", "value": "fef92b1fa053b0c2248ffac9f6b576ec018beb3ad7f5f37b8f5b1d90b014ae9f7d94c5b2e2883282902d160727c06c45", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646825939, "uuid": "e40a76ed-636c-423f-86cd-9110b3e7ed3e", "value": "T19E228C78D511FD22C232547DE96C80F0EA69B583EA627C2D2050B3AD0B600C397CEEF9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646825939, "uuid": "cb26dbd2-9642-44fd-90a5-5b6d0f90c13c", "value": "192:ScIMmtPilG/b/UdlON4amWBXBQXldd3cGzl:SPXKw/UdlON4oRgldZL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646825939, "uuid": "0f10c51f-e650-4bb2-9437-559c06934632", "value": 10341, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646825939, "uuid": "b36de1db-4c04-4847-a9c4-f50e7f395280", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646825939, "uuid": "5f73cf25-554c-49ec-80e3-47aeaf7dbabf", "value": "Hon Hai Technology Group. (Purchase Order No. FoxconnPO7038475).docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3a5d5ff-9f71-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1646807204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646807204, "uuid": "790244e6-f39a-4370-9dad-d1f87c57490b", "comment": "Malware payload (AgentTesla)", "value": "05ecd2d842b8599919861c8589cd0aea", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646807204, "uuid": "13be6acf-e941-4eee-b43e-98659250ab7d", "comment": "Malware payload (AgentTesla)", "value": "2a1b84fa7d3c6fa6d8031d81b684ae2cd7f3693f2fca69af56956931c9452fb7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646807204, "uuid": "c789f802-61ce-410b-b5c4-3a71cb45122a", "comment": "Malware payload (AgentTesla)", "value": "84da39d4c1073a0317cf2d8ad6731403549ac98f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646807204, "uuid": "2dfc554e-9e7c-4717-9b67-e264e42ed340", "comment": "Malware payload (AgentTesla)", "value": "be1e9c751c4ef7c048afb8898a726ea1a4ee02ba88a0f0a63875139aba14fbb5a18197d9a8fdbcc371e16f19d789c528", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646807204, "uuid": "72333d9c-1aba-4d8d-89a3-3d510f82c9d1", "value": "T14515E79C712031DEC96BD6319A649D78EF503C7B832B411F90A7359EAA7D987CF240B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646807204, "uuid": "0aa18633-1d9f-4faa-a696-bdf9b6fe45b7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646807204, "uuid": "48acabf2-2dd1-45ff-bfa7-543666adb257", "value": "12288:Xrqcab5v/SyQNsWN8dNcHNE+JmW6MT0RTMDEdwTeqGC5qINGUwfr3c2bv9uOFfqn:XlabNQNN3uDlTMDidqGxUc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646807204, "uuid": "263dbb41-bff3-4f29-abb5-83c578218ebf", "value": 939520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646807204, "uuid": "58c6d420-2d5d-44da-b45c-8f4a9624e621", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646807204, "uuid": "22efad01-f525-4574-b2e7-e61fc14f226b", "value": "SOA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c36c17f4-9fb8-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1646837644, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646837644, "uuid": "1f0bd3ae-524d-49a0-9824-775c4ef91621", "comment": "Malware payload (AgentTesla)", "value": "ce4b6f1efe1e223ab632d92079a7f66a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646837644, "uuid": "997374e1-b34f-4525-a1e2-d22725b00290", "comment": "Malware payload (AgentTesla)", "value": "2a2410563b933fa2b2f58ca26d45b170bb88cd5c54d47893b11bc35fb8bc857a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646837644, "uuid": "d3e0332e-bd9f-42f1-90e0-beb619eca643", "comment": "Malware payload (AgentTesla)", "value": "ceeb6ddaf40cf44981ffebfec7892183304c759b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646837644, "uuid": "cf14adba-eca9-438d-aee3-27d1224c15f0", "comment": "Malware payload (AgentTesla)", "value": "a3540b8c0e394dfd1028e11b9a65a25176b01d266a11f73292e9fdff56accff3e2bb20f621c1eb1f492e9199d1320efe", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646837644, "uuid": "dd664196-06be-43f2-9c1c-85de63cedd7f", "value": "T1301412307DDDC73ACBE1453616D584E0C61BDCD0E89AD64E7026B725E970F062A8EB4B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646837644, "uuid": "05f3957f-02c3-46da-aa28-1ad3d4fc50ac", "value": "3072:OCuZqb+mEOJywcr8jRVyoCsCkTrHzcfnyZcpMfRD36Q4KsMnv4H6aLdw+48Evpqs:v+mEgqr8jRVyLsvTrTcKZqMF3p4K26ES", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646837644, "uuid": "0268f929-3d66-4055-93f4-61e364f0b168", "value": 190888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646837644, "uuid": "ee9865ad-8986-4e1d-ab05-3f138b87cde0", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646837644, "uuid": "83a0d7d6-c3d5-4911-951c-48a2d3a6ead1", "value": "Statement of Final Account.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e5d5a1e-9fbf-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646840481, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646840481, "uuid": "b86af956-9a4e-40f9-b9d1-38569119598a", "comment": "Malware payload", "value": "ea1fd5f3433baa0427fcd3abf8ad0af1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646840481, "uuid": "4c7d1a31-5774-408b-848c-927225238401", "comment": "Malware payload", "value": "2a992067f162bce9990550f66fa4a43b947a43b6e5492138ebf0f7204b645bdb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646840481, "uuid": "8a8886cc-c419-436d-b009-94b3baac5d69", "comment": "Malware payload", "value": "91cc5c9f46b8e945dff2b62f5a201fcf7e815339", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646840481, "uuid": "b90f3910-cce0-4aa4-a0d4-d5b69791a200", "comment": "Malware payload", "value": "e62266141e06987ed2e509442523ce893092c494a70f920c523de6d558e061866748d6e8b341cfea4877d04f5979f565", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646840481, "uuid": "52e0e856-4343-4959-87a7-62496c4423ca", "value": "T1B3F2F230D09E5E36FBA7B5F70D96CBC32A206BAD79354FF322415B104D287510D0B985", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646840481, "uuid": "ede04e54-7826-46d4-8bdf-c9ca0bd41be5", "value": "768:dQSiBU4HM5Fv78N1jwbqozkucPv3K9za0xATPc34qX4uVcqgw0RTWXW:dsBHYFvXZIucHKhBIqX4u+qgw01WXW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646840481, "uuid": "0ba979f4-a525-41be-8be9-c968d4ec03c9", "value": 36084, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646840481, "uuid": "e6fa3781-fa45-4333-88c9-33a945fac09c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646840481, "uuid": "451e2c97-1b5a-4f79-a857-0075421edc00", "value": "ea1fd5f3433baa0427fcd3abf8ad0af1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98a05db3-9fc1-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1646841437, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646841437, "uuid": "cd341022-88aa-4f31-8a90-b37408a3e19a", "comment": "Malware payload (Mirai)", "value": "58ad5ff2f031889eec7bd019f0d794ca", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646841437, "uuid": "bfb46978-ea4c-4ffb-9c8f-479ec5ae6ae0", "comment": "Malware payload (Mirai)", "value": "2b2e843dc0e36c21eae10c7830e2fac28565eda07e7ecd6783f4440bb9aa7d70", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646841437, "uuid": "329a2fce-88a3-4ad6-8285-59562d1f2451", "comment": "Malware payload (Mirai)", "value": "e759b3386b7746bba2ba9d09784df68f2c752e91", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646841437, "uuid": "3f238f75-1ac8-40aa-a930-d1fd0e991bc2", "comment": "Malware payload (Mirai)", "value": "c449d290c042cfd02fe042fb7e70786f90e488b23771cb72d5306d45b293f6edf28f24f68299b366de87862adeed0981", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646841437, "uuid": "141c64dc-e5b5-4b1a-9c94-d623efc01e58", "value": "T1EB335B22A9791E27C0D4F47A62F78729B2F50B0E25A88B1E7D620F4EFF214C0556B1F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646841437, "uuid": "e2056fc4-0711-4964-a7c9-72c604ef9bb6", "value": "768:g87vjw1o6q9m+xy5agNdXEGgp0lBddWMbMeO+hZr1Fuk:lvjw1XSm+xytNdUGgp+BdkshV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646841437, "uuid": "7d4b3a27-7ab8-4559-b309-33b2efbdd2b6", "value": 54740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646841437, "uuid": "8e30c758-b119-49e4-9588-83adaef05d37", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646841437, "uuid": "67d04b60-bf01-4403-85ca-1c918850f298", "value": "58ad5ff2f031889eec7bd019f0d794ca", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d889b32e-9fde-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1646854000, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646854000, "uuid": "23b99c65-2c42-461b-abb7-2980ac2f853c", "comment": "Malware payload (RedLineStealer)", "value": "1597323acab489ee1798a38278a08b2f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646854000, "uuid": "58f9c6f7-c654-4986-a6cb-d4c27094f72c", "comment": "Malware payload (RedLineStealer)", "value": "2d82e375212398a13c0f1af63384143534ceaeacfe0afd9f316bd7a497d7ac88", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646854000, "uuid": "cde0fd6e-bc3c-4bee-a586-1de0f9cf4e8e", "comment": "Malware payload (RedLineStealer)", "value": "a585e9913d39f48ed7dc1a294f69de5d9466fff2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646854000, "uuid": "7beaf9f2-cb00-48be-8d79-a0df7bbe5b28", "comment": "Malware payload (RedLineStealer)", "value": "6fe254903aa1ea52c978171a6cb6829c4d4f42b7aef522b25ac876a8c084df7b03aa194a12a84f0bb1af8786a1d682ce", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646854000, "uuid": "bf08d8d2-bf51-44d0-b0c2-c40449d3756f", "value": "T1EFA34D6973DD4628F5FE4EB468B1519153F0F1A2AC03F79E4EC4E09D1926B80DB22BB1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646854000, "uuid": "6ec396d9-b671-4408-9841-4c4191e0d31b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646854000, "uuid": "53adc872-f6c6-4ff0-b82c-4fe989d7c810", "value": "1536:p0DEkCrsG2IxAacZr8eudVAqHp+yfW632hDoj64buTxvIsHhiLM:p4CrsGh592opQobO9HwY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646854000, "uuid": "b1a0fcb9-6363-488c-87dc-dfd6f2c72bee", "value": 104960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646854000, "uuid": "4e731b18-b30a-433f-a9b6-491091caf2fc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646854000, "uuid": "32289bf1-5c60-42aa-9855-74a1f1b7a146", "value": "1597323acab489ee1798a38278a08b2f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6aa93c99-9fb2-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1646834918, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646834918, "uuid": "048b9831-580e-4419-9dae-6245e7d0114e", "comment": "Malware payload (AgentTesla)", "value": "01035dc5dd768708a1b327e7b7b0ad63", "object_relation": "md5", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646834918, "uuid": "7c02aac4-078f-4b48-a735-ad7eec273258", "comment": "Malware payload (AgentTesla)", "value": "2e8d5e4f11eab058502c3acc1e91a6dc3c8b0644ce61e619c712401c4176d626", "object_relation": "sha256", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646834918, "uuid": "eb7cf6a5-a07c-4193-ae16-407a80a22b38", "comment": "Malware payload (AgentTesla)", "value": "81b43b1a005d060419e1f2f85b38baa78644fc33", "object_relation": "sha1", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646834918, "uuid": "4b77cceb-01ee-48a0-9327-5365aeaef621", "comment": "Malware payload (AgentTesla)", "value": "7a8649b20425e0f8a31f17b17f376d16524662de402ccda5658755fad341f377f2d4ebd12011b54f8aefd272971075e3", "object_relation": "sha3-384", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646834918, "uuid": "450ed23a-88a2-4fa1-a926-9a28187eee4a", "value": "T1E4C423C0DFE89273C8116C6EDAF919F946F6F52C619396B41F0E4DAE1C919610F33A22", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646834918, "uuid": "36e1bb1b-57f1-47ef-8422-4f32a299edd0", "value": "12288:ftJayvXJ66Ot3muF0xtChdbUX96lTzaDBer039WbK5lELCVtaj:f6yvXJZ43T2sY8CBeq9WG5vVtaj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646834918, "uuid": "fbadf029-1839-49c1-9c64-480af589ffa7", "value": 545471, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646834918, "uuid": "4dbf0e90-e5ab-4b90-8e21-07833afb0687", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646834918, "uuid": "832785be-7710-49f6-b80e-b0f1273cb621", "value": "PO-206 Speaker Grille_MS.7z.001", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ce3481f-9fbb-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1646838868, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646838868, "uuid": "cc85fd04-9cc7-4784-9084-0b2309b858d6", "comment": "Malware payload (AgentTesla)", "value": "f697d8906b7060ba7fff649e2d361c36", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646838868, "uuid": "507618ce-0220-4355-bb68-eaf106bc290f", "comment": "Malware payload (AgentTesla)", "value": "2e90f38ecdf1318742e3ec0978315e0ddc97f0d638eff92d0d389c37ee6c0705", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646838868, "uuid": "d30f836c-519f-493a-87e3-b4336a5e13f6", "comment": "Malware payload (AgentTesla)", "value": "d0c73d1ad022ed97b8b8a7d047e602b7b4b2efb4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646838868, "uuid": "f8e3b11c-5c3f-4b24-ab75-43aace956397", "comment": "Malware payload (AgentTesla)", "value": "6e4edb175bd71d10a62f6ba8b1ae2d6d2fc069aac691248879cfc5b932cce4b675079695b04cbca1d5dca85fcba001b5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646838868, "uuid": "ae3a5a22-7d8e-4147-a3b9-472289bbb8e3", "value": "T1FF25BF14BAA1607FE16B8D760BC0AC2399D7B5720206E2AF2C1EC64D4FDA57ECD91C71", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646838868, "uuid": "33bb13f9-7042-4597-947f-6b5d15b52e5d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646838868, "uuid": "6fa5924c-2c88-4728-9cf7-25dc3278c425", "value": "24576:xjF9CqDYLPI9+zR0VTGpxr/DOUZWjxUs3oXi/FM5BuWx2HpCmLeSSf:wPI0zyEpV/hWjxUs3x/u5BuLPq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646838868, "uuid": "bec9b6ef-1363-43be-9657-cc63d27a9642", "value": 999936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646838868, "uuid": "9deadc70-0c80-43d9-a575-c73a60a799be", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646838868, "uuid": "477d0aaf-7596-44d5-962b-ddc0bad00d35", "value": "platebn\u00ed kopie.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42e165f4-9fb8-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1646837428, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646837428, "uuid": "56fd7ada-7f22-4c96-8303-9a0b9c644b01", "comment": "Malware payload (AgentTesla)", "value": "bee518a70c6d6465dc07ecd1e29b1966", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646837428, "uuid": "14b32374-e2d4-4d34-ab82-bb3e8139b878", "comment": "Malware payload (AgentTesla)", "value": "2e9343b1e672905154ceeabfe0de7d08426cb87b1941f7ff5758280d396db85c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646837428, "uuid": "37015555-b43b-4c40-ab93-93b753c7799d", "comment": "Malware payload (AgentTesla)", "value": "b28f55a8e57974b5e3fc0db40cb74b94edf87539", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646837428, "uuid": "c3031edc-0072-4142-9e1f-6bf02f6b6c52", "comment": "Malware payload (AgentTesla)", "value": "86d6e1c5f7a4a4ac54c760206f4d13ae9899ee0a6d80945f2326cfff4b73fa5fe7cb6f94291cbc69a90937cc236aa03f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646837428, "uuid": "e9c4a9d3-a730-4efc-aed9-b1540d807c6a", "value": "T1F3B423607BB040A7D846CE0B0B2E88F75006D887A5D63F3B29D7E0C7A5D5E6D3CA7295", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646837428, "uuid": "b1c6de41-3094-47ed-8454-66d241c1ab8e", "value": "12288:Cf0g0rXarQJo4QIgihklIemQoAydEHz2/8BY:w0Bqr+vhTeB7ydf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646837428, "uuid": "64733a92-4ed9-4655-a430-c24e5bc81828", "value": 528054, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646837428, "uuid": "53d499fa-98a3-4d73-8a3d-0f0b1fce6d66", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646837428, "uuid": "24255878-310f-49ce-8385-414f91b452d0", "value": "bank slip.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91844207-9fb8-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1646837560, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646837560, "uuid": "e06cda03-1458-436a-81b6-0cae8c598b49", "comment": "Malware payload (AgentTesla)", "value": "125803435edc2304dda2a4af44b87665", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646837560, "uuid": "2e86968f-fca2-4e54-b1f4-970f4b0c9d3c", "comment": "Malware payload (AgentTesla)", "value": "2e9c8c7d4039b3d4400233b4566e0c7624f8d269a0d765bec308d673dde871e5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646837560, "uuid": "5ef7c62e-4d4c-4c9e-b293-ab5182eab4a2", "comment": "Malware payload (AgentTesla)", "value": "c00c8646b89f289f32318ddf33230c105b287280", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646837560, "uuid": "62799330-0d22-4cdb-baa4-7b087aad3949", "comment": "Malware payload (AgentTesla)", "value": "844029697364e3e88a6c2b9d9aadc1eb733d6c0ec5e261e61b30a4e27bebdfe5a3adfcfc4920c8038f34cf29269a22af", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646837560, "uuid": "765be453-32ce-4025-9d01-ae2286e36c50", "value": "T14F1412183A73CD17D8992BB054AECC14D7D5DCE9862B41F342E8362F56BAF8094E398C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646837560, "uuid": "d3c952e0-f1bc-4103-ac73-648e46abcd29", "value": "3072:3AKI0yqEK2/V79Jt1XgwdUdsBCHAyaBdac6o3wlE0sdmQRCv29tFlWvhO3u5:iBK2/V73PQwp+aHac6dy0sdmb29tFlWx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646837560, "uuid": "47beb74e-31b5-41e0-b825-40e222d9e6c1", "value": 191272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646837560, "uuid": "e27fe332-8f38-434b-9dcf-79756ec7ee37", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646837560, "uuid": "40570192-2dce-4f9b-9d1b-0b901c66db1e", "value": "AWB_Tracking_0309202209837430000000.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43fc3cf3-9fbc-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1646839148, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646839148, "uuid": "8a03a72e-22b6-48d7-a940-cf89d91144d6", "comment": "Malware payload (AgentTesla)", "value": "1baa38669b16cd908b8216c5dfe83472", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646839148, "uuid": "89c14f50-d87c-4608-96ce-6e0c27ffcf1d", "comment": "Malware payload (AgentTesla)", "value": "2fb0fd5bc5e7ef967ef16373ff36c709345e971a50382416d521ff205542cbae", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646839148, "uuid": "0ff5fdf0-1b0d-4472-a1d1-17d17f55d423", "comment": "Malware payload (AgentTesla)", "value": "9b6083266eb75fb7ca27e0d696123509464f5338", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646839148, "uuid": "2164ffd0-386e-46f6-a179-306e30de1d10", "comment": "Malware payload (AgentTesla)", "value": "f60d80902f63765bf672f51127a836e0ca27cfdfe9a093e5b28774e478a8562b61d855daa6ea07fe581226b1b6551f62", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646839148, "uuid": "5d2833e0-0497-41ef-9da2-e055263241fd", "value": "T11325DF10E9AA503BF27E5AB91BC1F86349DBE6A61604E0BE1C2CC6460FD163CDDD1D36", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646839148, "uuid": "548b6f6d-9bfc-410e-947d-045449b02183", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646839148, "uuid": "6807b7e1-6f0f-4609-8a8c-261a93d71b94", "value": "24576:AlfW5yPZecHg+oTtuxahQA8lspbAiU6HdHX3FfKvv1:A45yBhHg+Cu8yhlspbANuW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646839148, "uuid": "201111ba-974e-4860-bd24-f13b57d2af55", "value": 1022464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646839148, "uuid": "f2530c4e-5430-4385-a11b-259ae1234ad8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646839148, "uuid": "949b0588-0cee-4d4b-9ad7-6003109b82aa", "value": "AWB. NO.1603915025.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73b25695-9fb3-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646835363, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646835363, "uuid": "cf80e85d-13c2-4619-918a-9993ad914ee3", "comment": "Malware payload", "value": "5a1cc713ce8389eb470ec600868d3668", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646835363, "uuid": "b156ff2e-944e-4e1d-afe6-3fb93d86622d", "comment": "Malware payload", "value": "2fdf647a72523cc5384e2fdb59cfb61e404972ccbec98356d7601e3ec7ab5963", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646835363, "uuid": "5406f8c9-9339-4227-bba4-c254f0fddef7", "comment": "Malware payload", "value": "a4517a1dad1a063ed4572e73794f5c4ac53d8796", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646835363, "uuid": "ff283cfa-0041-4fa3-b8ac-32a20d101233", "comment": "Malware payload", "value": "3df6c01a25718f5bd820a36adab7c54582e9719b2f56db68496fffeaa2f0ea3e53e6922e853113517e32adee1bed296e", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646835363, "uuid": "ade5bca0-4d5e-4dba-b0f9-3d99c262743b", "value": "T1FD0455B86FF46BBC8F4B7E13EE0F1A5A280385925177C8C4DF9457651A09861BCEE06C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646835363, "uuid": "f15018ac-9395-4cdc-af76-08cd266a94b8", "value": "1536:ywlU95Wg2eAv6NDesKmGXBCNDmZe3AKJ2V7J38DRuNDwxVYUQSPre0qbiwxWRUk4:yF95ieAiNDZAm6/VlE20iU1CRUo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646835363, "uuid": "d17e831e-537a-4e58-8318-8ac4762e83c0", "value": 181172, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646835363, "uuid": "709a5505-adc8-4f07-bf97-4f771eee8a2f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646835363, "uuid": "dd541ee3-bd44-4562-839e-a3e71ace78e2", "value": "Regnskab-43120918.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eeeebba3-9fa2-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1646828268, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646828268, "uuid": "5c7c08e3-31a7-4c73-af07-cd3822611102", "comment": "Malware payload (AgentTesla)", "value": "d50a5425600394525313a6f9e8fe7ef2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646828268, "uuid": "d63f7221-8030-4c4f-9756-0ccfb8f527af", "comment": "Malware payload (AgentTesla)", "value": "30742170ae6f9267db52ef6ae4d80173c2bf42b4a0679fe8161d2e5de4b5015e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646828268, "uuid": "a61d8b81-afaa-47cf-a7a2-d8b4b2f9dffb", "comment": "Malware payload (AgentTesla)", "value": "d07cd9ef4dfd8319915212089914d0df1dec72ce", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646828268, "uuid": "8dd90aa4-f555-4d29-9d4e-274791e4079d", "comment": "Malware payload (AgentTesla)", "value": "6095e0cc5f7f341627b9f2bb2a0b46a2932dde1cfef9ed8e98544b3bb04739f602f070535a468d19b54ab31c54bc6d06", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646828268, "uuid": "86b5c793-ee72-45b6-99f3-653ef43fa259", "value": "T16F25D69C711031DEC96BD6319A748D38EB613C7A832B511F509739AEAA7D987CF240B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646828268, "uuid": "e2a748ca-ae13-42e8-9134-b53334801f14", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646828268, "uuid": "f9ba7408-b81a-4bbd-91e6-cacf78252fba", "value": "12288:crqc58oRiKovlM6xWefdVbM+cW7qeRolUysFmRuXg7Ah6VnCd5ULUKXoSkI3ArAI:cluoRije6DfLMtW7poCUp1q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646828268, "uuid": "abc80470-2436-4615-bfbd-181c0841bb62", "value": 963072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646828268, "uuid": "6bf49bfd-002d-4e13-9d67-186dbc5b0518", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646828268, "uuid": "8911364e-42dd-495f-8cdc-d824e0e0c78e", "value": "Inv-2805503.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8737b4af-9fb2-11ec-9275-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1646834966, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646834966, "uuid": "9b522613-a26f-455c-8b8c-6e4c7fbce547", "comment": "Malware payload (SnakeKeylogger)", "value": "5f69ba69d5b9f6471d14a94b5c6a8930", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646834966, "uuid": "e72c3dfd-6e72-42fa-98d8-fe0050949f17", "comment": "Malware payload (SnakeKeylogger)", "value": "308ed1b37493a8fc1b37c5ecd5b9faf233dfbe444d6a7dd97f5898a2b084e4da", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646834966, "uuid": "4ba74833-0d25-4587-995e-62f914cbd731", "comment": "Malware payload (SnakeKeylogger)", "value": "0c1e37aa347d8821de301737fcb3dc4521f57417", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646834966, "uuid": "f13a1017-1efd-40ca-b42c-0757e2e52ebb", "comment": "Malware payload (SnakeKeylogger)", "value": "170d58f9a11972890786a96a527d4eef217162c79cbd53a1dad16c006fcded582c47130fb834ca613c36d0e90523d28c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646834966, "uuid": "395c13cf-13c6-4de8-8d26-bf5e0c679d2e", "value": "T1B3E42374B6E8A9DBE86B0A700D89C43486719B0DD589000F77767FA86AF3677005F26F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646834966, "uuid": "cdd4178e-46c6-497a-9ac6-ee65a7429895", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646834966, "uuid": "707800bd-fb21-477e-ac68-8a0398c5a50e", "value": "12288:+lMCxuw4uu9qLPSNDRssTbVyzP+MoVVCz6fbp3VlIfqWs:YohAP8ssAzvjAbp3OqH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646834966, "uuid": "ddc82634-8af1-4d7b-8b3e-2fb69a928cdd", "value": 700976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646834966, "uuid": "6c334578-df45-4883-be20-c1b9d8fa50a1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646834966, "uuid": "345783f5-c683-4a31-b233-79b30084b118", "value": "SK09876278909876545678909.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c4cff01-9fb6-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1646836719, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646836719, "uuid": "a62a8293-6fb9-4998-aac9-a8a2b6b5c1b7", "comment": "Malware payload (AgentTesla)", "value": "c0556814aa249356dc8129960d6a0c02", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646836719, "uuid": "f3c99f3b-554a-481b-8221-97504af7d90e", "comment": "Malware payload (AgentTesla)", "value": "30f27e3df5f77d66376472d212cad82f1999b7c97327d7e677bcb51cc36f0691", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646836719, "uuid": "bc3e72da-72be-4636-ae06-e49977361173", "comment": "Malware payload (AgentTesla)", "value": "a938568f342dd674869f39b5216e71fbb12cb141", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646836719, "uuid": "092d2a51-2b1c-4e2d-a044-ab452dbcdb93", "comment": "Malware payload (AgentTesla)", "value": "2b362550158a68151e704c7d2dea4359d84f9fb0378eba705de2a22287ed30fa6c1e19885f09c288773ec7e8554dae2a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646836719, "uuid": "0bbbf846-f52c-49ce-90db-d783f7dab606", "value": "T1CD1401B9FE6E4FB5E9A7D6320CA3D1211D3BFDAC1B14525984C27C1E43798C2C492B62", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646836719, "uuid": "fa457e22-4350-4f4d-b9c1-57e3e9f9e9e1", "value": "3072:iQ8D9i7dGO7+rFfpO5Y6KWzDej2s/vXm3dClIe9+tKWPf772ioebPUBikWnayMyg:V1yF6KCDeSsnXm3dg6vL72ioeby25Myg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646836719, "uuid": "feb2c1d5-097b-4a8f-b072-85ae021cfb98", "value": 190792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646836719, "uuid": "f6367254-1589-4149-87d3-64ec88b51eac", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646836719, "uuid": "e6d86817-425e-40b4-a50e-94f11ab39df5", "value": "Official PO 0201a-2022.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b19adeb0-9f84-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1646815280, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646815280, "uuid": "3fc3395f-c0ea-4168-8fcd-dd8aa0d73cff", "comment": "Malware payload (AgentTesla)", "value": "8522cf2ed656166ab248586f2d38a08d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646815280, "uuid": "450d5568-0461-440f-a522-f841a82fd282", "comment": "Malware payload (AgentTesla)", "value": "318fa24e1047569ae2129e136709b9fc39dae8093960fde856f93375160bccd3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646815280, "uuid": "b409c162-7c50-43e4-a09b-b4bd5dff80b0", "comment": "Malware payload (AgentTesla)", "value": "58cdb865c6ba029f3b7fbf3b5ae1cc5af618a3f8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646815280, "uuid": "bb792226-afd9-4702-90eb-5dac81818aa4", "comment": "Malware payload (AgentTesla)", "value": "c87d1d49d9053c58da7097b8900f4bde5fd4332cc20f277a5c5a6f128c714cf273a305657feb9277744efdcbf0aa84d3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646815280, "uuid": "a0778bb8-1d85-48c6-b42a-77c14dd24f53", "value": "T153942372B31B4D3BFA535DBB65527D4E25E73728488C563F9B0DE30A22D2A8C3807865", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646815280, "uuid": "cc58148e-1779-4b32-a7f2-b74a0227b496", "value": "12288:/pwsASLzzVNYJtwS1h2QgQMPg94JlZhiJbm8nDTD1AnMQ:4k6tV+npPg94jZoJS8ne", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646815280, "uuid": "af1b2a5f-77f9-4316-b0c7-cf287aa874b0", "value": 444971, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646815280, "uuid": "5e1f9e23-24ba-420d-8389-c1365dd32dee", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646815280, "uuid": "01efd842-d75e-4981-b9c4-6c09d33076ac", "value": "PACKING LIST.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c086bf55-9fc1-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1646841504, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646841504, "uuid": "76e97aed-3b4a-4b59-900a-adc037978e17", "comment": "Malware payload (Mirai)", "value": "1d7fe7799489f3cc36cfb6d10a5a5897", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646841504, "uuid": "1ffd9588-2247-4569-9f40-acd3b9eb5a6e", "comment": "Malware payload (Mirai)", "value": "31c97122ea4a88c7f193efcc00083514b0f78fcf37ad83a2e2f43efb82eb034d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646841504, "uuid": "6cd4d8a7-3597-4e04-a404-7b2653b27776", "comment": "Malware payload (Mirai)", "value": "53e0fab35bcccca001d6a6410ee28fdcaaa50374", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646841504, "uuid": "ecf5b633-56dc-443a-b5ec-31ad2edf56a5", "comment": "Malware payload (Mirai)", "value": "5ca74ed17f9923e1a0ed72a660168ff8c98a46011063dc2dd2e9cb4b084b8eff478b05616ff76106f002da0d3999b8ad", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646841504, "uuid": "d2ef30d0-d959-4a84-b279-f7075641a0dd", "value": "T1A163954E6E719FBCFBA8873447B75F209248339626E1C684E15CEA011E7030E745FBA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646841504, "uuid": "4e1c4308-5dfd-4ed7-a955-066da69c6dec", "value": "1536:D8aCKgFqz+SIjtr3st2jpoJtFHJUfTUkPK01eef:QH+kJr3fCJtrUfTUkPKkHf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646841504, "uuid": "2044cc8d-df1f-4df4-9c5e-ee6d074d3bd1", "value": 68272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646841504, "uuid": "64ce90c6-ea82-4a0a-88da-8961e8a8ca8e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646841504, "uuid": "5babee05-ab3f-46a4-9b1a-3ab5bdf4420e", "value": "1d7fe7799489f3cc36cfb6d10a5a5897", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5ece188-9fb0-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1646834212, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646834212, "uuid": "2217c4df-a201-41b3-85b3-7ce94d59f637", "comment": "Malware payload (Formbook)", "value": "2903583559f923f0e97fd390020d4ff8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646834212, "uuid": "ef44346a-9714-47ad-a0ce-b6ce9accdcbf", "comment": "Malware payload (Formbook)", "value": "31e25872ab09c0b33f745aa10dc7f715411f3ca0cbb3bf31fcec879f9923b7c9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646834212, "uuid": "1cb59e92-dff6-4fb1-a19f-8054a8df2e58", "comment": "Malware payload (Formbook)", "value": "3c973cd3069e00a227f16872163b25bc4f5a74fe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646834212, "uuid": "d1e2006d-1fd4-4f18-9d38-1f1c2965bfb0", "comment": "Malware payload (Formbook)", "value": "1d21059321aee6f8cbe7df0040918c2808e5fa7f316b243ce8149893a189f47ab66db7bcade4cfd104d03e7d4aea628c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646834212, "uuid": "848566d6-0819-4197-a6b9-2bee346ade70", "value": "T1FEF4D69C312431DEC96BD6759AA81E68FFA03C7B831B511B901731AD9A3C987DF341B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646834212, "uuid": "8ec0abf3-ce35-4c89-b3ec-f7eb28a462d8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646834212, "uuid": "6448f056-217b-4be3-835a-04348e861f9b", "value": "12288:1X8cRavmBK2z3OBdGo0gSp7PydUc5ZIGn3HpZcmfqIz5BxItaMtoCNJc9ulO68bt:1ngspz8UUb1n3HpZcOF5BvU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646834212, "uuid": "3d0ed909-6434-4e1c-b05d-2cb51e8bc165", "value": 779776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646834212, "uuid": "42237ab7-0a28-4a02-917b-9944fbf81471", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646834212, "uuid": "b63ffccb-1445-47b6-bb14-ab61df7fdbb8", "value": "Amended invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c522051-9fcf-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1646847215, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646847215, "uuid": "f4062849-2e94-4e40-b663-d405ea023e94", "comment": "Malware payload (Mirai)", "value": "6d06a39c7f562b306d7632fe3e2608e1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646847215, "uuid": "284acbfb-be67-403e-b96a-e2d4bad9bf17", "comment": "Malware payload (Mirai)", "value": "326d2674a34e8329b1558c55ef5db9bab7c0bc0ca8721961d827fed63db53e6c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646847215, "uuid": "339ad406-cf92-42b5-abc9-8d29b404e828", "comment": "Malware payload (Mirai)", "value": "3fde547df21321dc7ce84472445747f8c775ea23", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646847215, "uuid": "e8683fa8-9df6-4807-b04c-cecb692bf4e2", "comment": "Malware payload (Mirai)", "value": "d5832fad6578e71200a1e5ad85ee32d094d877261f9ff0f743a52e51010ea6d6c8823a3d67ea78a77c5aa08c345dd732", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646847215, "uuid": "3e8a484f-f707-490c-ba5a-afc904c947eb", "value": "T10C63F85AB8918A11C5C513BAFE2E118D331753B8D3DFB212DD106F50778A96F0E7B852", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646847215, "uuid": "1ef2ba75-156c-44a0-b9e8-20d56775dca5", "value": "1536:W5nygeJ4liswxQAz7mSi793h7nxczKjCY6VyRmfGEsrm0HiGLgICiVBpyZWj:NgX9AHmd1h1czKkVHfGEMm2BpyZWj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646847215, "uuid": "e0c581dc-9eda-4e07-b0d9-47cd5cda6390", "value": 70924, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646847215, "uuid": "0d0c0313-e4d5-4ca3-bfff-bd8f6daf8daf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646847215, "uuid": "fc915688-78e8-440f-b1bb-8a950c82ae0b", "value": "6d06a39c7f562b306d7632fe3e2608e1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73a3932f-9fe5-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646856837, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646856837, "uuid": "04cde89e-f97f-47e7-a64b-d97d1fbfc167", "comment": "Malware payload (Heodo)", "value": "f3afcc5ca01e642b0ecd49c07ebec844", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646856837, "uuid": "d55b1275-a819-41df-93cb-c5e35caff536", "comment": "Malware payload (Heodo)", "value": "33e84975e299a97063003275effc1208662935b4233bba987277aad943fd224c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646856837, "uuid": "7afd3532-62fc-41f7-9c48-ee8ea9dac118", "comment": "Malware payload (Heodo)", "value": "36db09930e413e5469f170c19ac1b724f5bb67ce", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646856837, "uuid": "a5f55cc3-a2f2-423f-a79e-b338fabf4b9f", "comment": "Malware payload (Heodo)", "value": "3204949c85945d4ce963a493bca715bbfbc11893443da8003d398f8c3b41cb3f1c3495f46d2640ba7896a2d2473f2d44", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646856837, "uuid": "85eff254-db51-4af3-9e15-49f524b3920b", "value": "T1F8257C107E8A817EC71B85B30836676D6FFEAB204B6CA1CB478175ED2D316C29B36705", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646856837, "uuid": "65430d07-b91f-40f6-9240-bf517b1b8ffe", "value": "087c9809507dfca4c3283e6c7539e91c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646856837, "uuid": "09fe0ea2-bc63-42d3-a327-84503e7686c4", "value": "12288:cR5SOyRHiA6m0OcElNzt6JtcS1j2xKkr:cR5SOrKlNzEtcK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646856837, "uuid": "90e4a90c-21f7-41ce-99a3-04c21b70d840", "value": 1040384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646856837, "uuid": "0348f6c4-d985-4632-b163-c1fd99549516", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646856837, "uuid": "94e45833-dd91-4faf-b25f-e9d8da259dff", "value": "f3afcc5ca01e642b0ecd49c07ebec844", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56951d1b-9fbf-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1646840468, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646840468, "uuid": "bee456ae-99a0-4330-a4d7-d157e25da1d5", "comment": "Malware payload (Mirai)", "value": "b619507c7c9744e540bbbcbfed17b0a8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646840468, "uuid": "1aa2a65f-65e7-4ae1-8876-cbfa21ae7e8b", "comment": "Malware payload (Mirai)", "value": "34b1d2c74d01fa9d3c772fac6e2599e80867ec788fa1eb4f70a90fc92f4362e5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646840468, "uuid": "82201031-b482-448c-9730-4ac3106dc060", "comment": "Malware payload (Mirai)", "value": "3abcaf4b6f55254889ae665ed3ab3672ce27dcd6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646840468, "uuid": "f9d0a4e7-bdd2-4049-9b9c-5a999b747fa1", "comment": "Malware payload (Mirai)", "value": "0a2c33f1cc6325b7ee059f5072c80e71509f879bbb7d85a29bd36b7fac726c34d979dddb5a4e1f9449a3715af4ef70a5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646840468, "uuid": "779819dd-a996-491c-be2b-2e58d1ce8afc", "value": "T1CC13F110D2D1B2B1EA55763AEC0D014193736B76B1C133EDBB0A17D54FA189A6A7E213", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646840468, "uuid": "5ab196f7-c15b-4933-8e82-06f943d16546", "value": "768:3osI3mz8x1X3BZiFVUe+XI++WVzWpsULvhGYWAB6ib/ti98SIQF5QX/jaxSz2XqL:p6GY1X3DCSNXI+das4vlWA1FUIQF5AjJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646840468, "uuid": "044f59c8-7633-4270-aa47-f5ebb7ca22f2", "value": 43560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646840468, "uuid": "c2d1f0d1-53dc-4d4c-bc0e-ba795d3f1c77", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646840468, "uuid": "581d5e1d-6c14-4d6c-933f-0d4f1234567d", "value": "b619507c7c9744e540bbbcbfed17b0a8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a236a061-9f94-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1646822126, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646822126, "uuid": "2423ef2a-e9c8-449e-8276-3200d6f8b243", "comment": "Malware payload (AgentTesla)", "value": "46703672396bd41c152b539db356cc84", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646822126, "uuid": "2cebf4c1-154b-419d-834f-3d0c6dd8031c", "comment": "Malware payload (AgentTesla)", "value": "3515c76aec2fe97b85c3906dc97d47b85c9b01462e8dd04e3c6489c04e50ae5c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646822126, "uuid": "2057e429-dacf-44b5-94c1-f034cb71228b", "comment": "Malware payload (AgentTesla)", "value": "5f771b3d2b4e886e47ecbfa09b9f3ab6ff47a2c2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646822126, "uuid": "49ef6605-b954-4e8e-8909-ccfd5028d728", "comment": "Malware payload (AgentTesla)", "value": "e2bc95c0b61cb30c7d18b3d90af944fc38bdc28bc54f4d69fdcf21311726672cc908d5ac53b99663da6d9bbd712e5b46", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646822126, "uuid": "4eae39d5-aa71-45f9-970f-a6d4b87394cb", "value": "T11435BEE229EB401DF377ABB12FC8F8CE996AF573161A70DB10521B768423980DD61736", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646822126, "uuid": "081905f5-5452-4871-85cd-604f1e605aff", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646822126, "uuid": "0cdeb8e8-6866-49ad-97b5-545f2d7d8f3e", "value": "24576:JD5ktzhAQDlUcE2qGwgac57wgCuDLpl1d3g:JD5kphAQDlBE2qHgXjD/73g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646822126, "uuid": "6267bcf7-7303-4ed6-a236-a5c98238fda2", "value": 1093120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646822126, "uuid": "b888e144-8853-4c6e-9340-3271afe0edb2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646822126, "uuid": "d739ee01-55fb-4e77-acf4-f966bd589720", "value": "AWB. NO.1603915025.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2998104a-9fc4-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1646842540, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646842540, "uuid": "d050545f-aa84-4650-be31-7e6aae7568f7", "comment": "Malware payload (Mirai)", "value": "34c50a451d1570930460bb2f3cf6bd52", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646842540, "uuid": "5210bfeb-fe5c-4abd-b8d3-e0427ba3eb09", "comment": "Malware payload (Mirai)", "value": "35a8008c5c2ec63f0ac9dbbbf06b173effd7577a39273d652925b5b224688f2f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646842540, "uuid": "3e7d917f-a34d-4832-8d99-d017f0a423d2", "comment": "Malware payload (Mirai)", "value": "a8c0febcce1acdc3363c840bcef27c3b1e34065d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646842540, "uuid": "51e2c3bb-b7ed-4a16-ba5a-458a2f4aaf44", "comment": "Malware payload (Mirai)", "value": "3b4ed636f7b4e9d96bca9fcc4c178e922974f4898d2cf303a22e1bdcc02aaea3afe826cbfe4396607d83b97d75eab0ba", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646842540, "uuid": "4fb184fc-060f-4b4e-abb1-950e5338a9ff", "value": "T19EB2E130F168AED6EC5FDCF94DA685C037F0AB95748998E2A401FF43C600622D934ACA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646842540, "uuid": "4b19258b-1126-4b69-921f-318173b13e31", "value": "384:1iBp4/P4BvyXKlBovwq9tagujiZ6KxjP7bMPrFyhtQnC9eZaO1m3WZ3cKG9NTC6Q:8Bu/P4Z/lBZqdEKxwPRItuC9eZzk3WZj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646842540, "uuid": "c752a5ca-417f-440c-9e69-69a77e676dea", "value": 24172, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646842540, "uuid": "4f083a7b-d855-456a-837b-39581d33ce7c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646842540, "uuid": "718efcf2-ea31-4bc6-970b-991312d85471", "value": "34c50a451d1570930460bb2f3cf6bd52", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbedf773-9f80-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1646813579, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646813579, "uuid": "1eb6d4b1-a0a6-40f4-a8df-b413925c3c04", "comment": "Malware payload (AgentTesla)", "value": "966b7ba4cb40547735f858e2593054ee", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646813579, "uuid": "880465d4-c256-4f89-8ac5-8d1797e836d3", "comment": "Malware payload (AgentTesla)", "value": "35d09ce8a46b53e7576b9ad807380a5eadcba9b87852cb8470e126e41e3de28a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646813579, "uuid": "c86b65a3-b754-4f4a-8650-685fd8506e6a", "comment": "Malware payload (AgentTesla)", "value": "64b53fb96aa69422a7db32db5f292f70c3206ab8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646813579, "uuid": "b91dcda0-345a-486b-83e1-b89dbafa4783", "comment": "Malware payload (AgentTesla)", "value": "48fb82951fe56e84399a6ed36fc58b3307b01dad6a236d1f7d2272f1e38493acca2e657d68202cd509a222905bee64f0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646813579, "uuid": "51bb9cbe-a823-4836-968b-706d1b76de13", "value": "T1AB15D08C3650B1DFC85BC976DDA81C60EA64A9B7570BD343A05722ADED0E99BCF005F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646813579, "uuid": "fc5247eb-3aaa-4004-9030-a019a8d05b25", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646813579, "uuid": "c8672b80-010f-4da9-bd23-e3f4cac0699e", "value": "24576:WHRIY4LZ02PR4VYcWk6f/QMmeSHDPEUo:kGY4902PR42cWHmXb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646813579, "uuid": "1422c348-8516-4831-93a7-ab22588b40d3", "value": 881664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646813579, "uuid": "fde7615a-dbb6-4632-b7ae-3793e48fac26", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646813579, "uuid": "c6ba3bdb-f897-4adc-a9fd-ba6a8e072fcf", "value": "4 Pallet Shipping Docs.Commercial Invoice. Packing List. Bill of LandingTHS00945872.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e56f7e82-9fd9-11ec-9275-42010a9c0029", "comment": "Malware payload (QuasarRAT)", "timestamp": 1646851874, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646851874, "uuid": "3aacddcc-63f2-41f5-bfaa-b3342929243e", "comment": "Malware payload (QuasarRAT)", "value": "9daad8a510c67855bc204ebe400a92dc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646851874, "uuid": "621896b3-49d7-4637-ad3f-42632700c577", "comment": "Malware payload (QuasarRAT)", "value": "3659778cc75ed1428fe16a288b28095311ffdc650a1202482376b4f3c04b75f3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646851874, "uuid": "c862c926-8116-464c-a853-f4c003a7e6be", "comment": "Malware payload (QuasarRAT)", "value": "95f5ffd073bbae37c2f6522527ef61d39412925d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646851874, "uuid": "da06516d-b48d-4784-b4a5-82dc7c08bb73", "comment": "Malware payload (QuasarRAT)", "value": "0d28e843e851db73aedbab5b3abd29269815935bf0a1207ab9c46f8c45d81fe31029daeacc49ca7bf13b7ffd548bcfa5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646851874, "uuid": "ce60083f-1508-455b-a346-6a1cb572925d", "value": "T161257CAB23052A45E8BFFA264CECD4264BF253EDC100DD936DB950C469524B93B72CDE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646851874, "uuid": "0a7648b6-ef2f-4e43-9e0b-19b0e6b5c559", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646851874, "uuid": "8c8703bd-1ff7-4477-899d-8739bf39c5d5", "value": "12288:lAWU+jrb6pPT1gxpMoR3QHxxlQHcIXZ7Wtavt6qHBRespLAgd1qk30cWTNiWMZUX:Y+Pb6AbjJQREcIJ/16qGs640TTJFV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646851874, "uuid": "cfeb0c58-5ea6-4a79-a187-16b6da788c16", "value": 1043800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646851874, "uuid": "48ee4e0e-22a4-430e-8834-939c76c24c5b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646851874, "uuid": "1f9040b8-187a-47d9-9c8d-04ee71653257", "value": "9daad8a510c67855bc204ebe400a92dc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47f35d88-9fbb-11ec-9275-42010a9c0029", "comment": "Malware payload (Renamer)", "timestamp": 1646838725, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646838725, "uuid": "1228ac28-165a-4e32-aed1-6bedc2c1aefe", "comment": "Malware payload (Renamer)", "value": "e832a3a8a115ade11f7ef9b3ed3fcb96", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Renamer", "colour": "#E80499", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646838725, "uuid": "18bc5ae2-53a9-4648-9b8f-aa855e2ced96", "comment": "Malware payload (Renamer)", "value": "368f43ab990257e04b362d2dcedd72f9d8d76ab2c314def5d6ef309841416908", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Renamer", "colour": "#E80499", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646838725, "uuid": "9886c04f-1f8d-4c78-892b-4c2548ac6973", "comment": "Malware payload (Renamer)", "value": "61520d074cda3dd6341b30eb9c11272cde98dabe", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Renamer", "colour": "#E80499", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646838725, "uuid": "5fb4cc9f-2b47-44eb-8557-eaccf4ada15d", "comment": "Malware payload (Renamer)", "value": "58345d1818133fba572f0f8a9721a763b436a9091311f2e9e6b22a1bd916a98959b230b11c9b4d8acad69cb4bfaf3489", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Renamer", "colour": "#E80499", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646838725, "uuid": "68eedce0-b230-4258-9289-766da7995192", "value": "T1FB75010BDEEB1167FC552B71D02548B310FBF9F60F464722B6E1E60D2A70FA166384A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646838725, "uuid": "29294030-dde1-43e0-8e5b-b3ffd0cc1beb", "value": "2f095340e94ca508e3b83fb009ebf4cc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646838725, "uuid": "d6335418-4f1c-4aea-a941-6a3f0d2a059c", "value": "24576:vcCT67wHqWis4l+jIACFr5hqjiLDpSJDN93pqb6W8cU4gLQmA:ECpn8t74iA3qb6W8cU4F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646838725, "uuid": "1e27acc5-079c-4bfe-ada2-14072b4f889c", "value": 1576960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646838725, "uuid": "1ae3e56e-a1d9-486d-a11e-5449338efca5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646838725, "uuid": "28120e4a-548b-4970-a110-81d86253f06b", "value": "DHL AWB TRACKING DETAILS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5a50c99-9f83-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646814911, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646814911, "uuid": "f54c6578-c881-43e5-8161-63df9640f2b9", "comment": "Malware payload", "value": "7d20ca62e923463706cbf661f50c2744", "object_relation": "md5", "Tag": [ { "name": "chrome fake update", "colour": "#D54661", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646814911, "uuid": "095d1893-5419-4011-978e-e3167d177aaf", "comment": "Malware payload", "value": "37786742ebacfb4dc006690461d684939a7fda75158c75773968ad076d08411e", "object_relation": "sha256", "Tag": [ { "name": "chrome fake update", "colour": "#D54661", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646814911, "uuid": "0e499c51-5d29-4bd8-bdb9-e8be4d9b1270", "comment": "Malware payload", "value": "e2dee2a9830cdc8258b95a49d20f7dd6e07d6a40", "object_relation": "sha1", "Tag": [ { "name": "chrome fake update", "colour": "#D54661", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646814911, "uuid": "6e45218e-b236-4bf1-a2ce-a3158f197111", "comment": "Malware payload", "value": "d7b860f3c6d18995312d14011d737ebc25938aae92b16bbe8f085d4fd35467e77442edc72dcb8b8904c8122303c0a621", "object_relation": "sha3-384", "Tag": [ { "name": "chrome fake update", "colour": "#D54661", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646814911, "uuid": "481732ff-f7cc-43b3-9753-dd8431af8c81", "value": "T16141E20A3AC9F24CAB4F23478E3D4543A94CCC358474D279654177F079E0E1B53A65ED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646814911, "uuid": "d711d531-9f53-4552-a734-df848e885c32", "value": "48:GvU6uQcuGkytQStG96ESPc+knd4+WLYoZ0JW2Vp1NkirSixdb43F:RahrStG9XSEPd4zLYZY2VSirdrcF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646814911, "uuid": "92e48b40-57b0-4444-92f2-9f914f678ce5", "value": 2432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646814911, "uuid": "aa4654e3-fa06-4497-ac7d-3e8430476ad4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646814911, "uuid": "9c1bc326-ddd6-4ffd-b485-fa3fcace2c43", "value": "Chrome.Update.40bff8.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e425e17-9fc4-11ec-9275-42010a9c0029", "comment": "Malware payload (AsyncRAT)", "timestamp": 1646842735, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646842735, "uuid": "45a9e72f-3bc7-49c6-91b0-24fcf28a9ab1", "comment": "Malware payload (AsyncRAT)", "value": "a2293f06319b61de548bcc14cf70fcf2", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646842735, "uuid": "a44c8ea1-2d6e-4a09-b56b-c6bdf31ff9f1", "comment": "Malware payload (AsyncRAT)", "value": "37926f13504fa75ea36299ddef20879372c4502136ef119d41c381faba6c261e", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646842735, "uuid": "d8b39880-b3e4-49da-8089-888d74670801", "comment": "Malware payload (AsyncRAT)", "value": "26a6c74753b429cc917e55a07995bd4e9a3e5927", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646842735, "uuid": "6bbd8608-18ca-4efd-a1da-10a83816d034", "comment": "Malware payload (AsyncRAT)", "value": "28b541e91e49334888305b1c3268e38c71e3c7da51f7930c45fdc0cb0c71516a88ac1ca36af01c9428ea2f2fb4e4554b", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646842735, "uuid": "279d3c96-fa28-4c2b-a260-433b2395e9c3", "value": "T1A4B31B35F2828452D4650238B04942B4732BDFC44E236A3A7B9FBF4D2B67E039E527A5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646842735, "uuid": "7c0519db-f304-4327-8deb-2698f8ff2abc", "value": "384:mUY0UxVdqwzelSLTuueEyuxFTmOETYLNwd9WEfdwO4UdW:mFo1+FTmOEkNaWkwSdW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646842735, "uuid": "ce57c500-b13e-4ca0-bb24-c547c9d8c0c8", "value": 112640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646842735, "uuid": "183f2ef5-bdad-4927-8a31-519af87949ef", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646842735, "uuid": "1f53da2d-d6fe-41b3-9bd7-0042b6630681", "value": "Wire_payment_returned120_vaw.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4576ee17-9fed-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646860196, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646860196, "uuid": "f8f49501-c48f-427e-8d20-2d06c3c8cfc5", "comment": "Malware payload (Heodo)", "value": "b6fbbde214c0ad5531d98916e1682213", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646860196, "uuid": "21c7a19c-9f00-4102-af3d-0314cbf6134b", "comment": "Malware payload (Heodo)", "value": "37eb82e3a6a1e5d2891188d0b1f6f1d52abfc59535639a4f128a693aa68bbed4", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646860196, "uuid": "51b4d052-543d-42a4-8aaa-6542c24fec5c", "comment": "Malware payload (Heodo)", "value": "6950cb0f81e0a55dc0c7c5b5acb6cf281e566d1d", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646860196, "uuid": "5dc6951e-8401-426b-a68d-558ca0e60841", "comment": "Malware payload (Heodo)", "value": "ebaa3737e63c0ba48853b9e2f202664e857102033b3ebc5c6c2a6b4fe1936cbe9093cb7392f38e5caa444258f06b97a7", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646860196, "uuid": "da333fb6-acd1-421c-8561-6e0b46150bea", "value": "T124D41950735AE1B7D0429CB58D1A82B5A90F6CA14A2471F3BBDE371DEB789B017213CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646860196, "uuid": "16f244c6-3923-4829-b967-1546d1815f78", "value": "463401f61c44b0d918f1e23374db995b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646860196, "uuid": "f8ffc503-a29d-4341-a3a1-fec0b3d90a55", "value": "12288:DjN/Z2wkRrA9CRDC7ElAjHDsndSyHOrNvEP0Oua:dEHR+CRByfsMyHOpJL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646860196, "uuid": "c001a3dc-62a5-4396-a306-efdb55b3af24", "value": 613888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646860196, "uuid": "6a73a7c7-3d70-4dff-a028-fb5cea201d64", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646860196, "uuid": "082ea6af-e18d-4b12-8542-2fd001bdfb83", "value": "sokolow.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3cf57d0f-9fd1-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1646848156, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646848156, "uuid": "6392ebfb-0494-44e4-be72-bc2e851302f2", "comment": "Malware payload (Mirai)", "value": "edf314142e7d570fc354d7b53437ead0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646848156, "uuid": "6a0021be-15be-47f5-b56a-313a44547853", "comment": "Malware payload (Mirai)", "value": "3839f5b97cdcf51a1bba1810cfabab695605f7b2671893d5d49f60406f312a06", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646848156, "uuid": "acd16f4b-650e-46cd-8f5b-6f472915ce93", "comment": "Malware payload (Mirai)", "value": "254c974d9872b2ffff4bcd494404c63e006d9076", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646848156, "uuid": "b7a0d327-d11d-4fb4-9c26-f03a3647b699", "comment": "Malware payload (Mirai)", "value": "70156bbd8a94bdd01e7987de040eb590d0a76217a69f485940941e04a9562e7857da097da5e0497d60077af00c21510e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646848156, "uuid": "804e5344-7619-4956-83a1-ec01ed9d156d", "value": "T13D831946BD819F01D5C912B6FE2E118E33131768E3DEB2239D109B247BCB92B0E7B559", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646848156, "uuid": "861aa527-1421-483e-8fba-fa76b5a71c43", "value": "1536:CxnjOSuwgUtOJ8gMeoJep0gNaIAEbSMDiYyom8Kxcl5kYG:FS09Qy0qaiyom8KxcliZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646848156, "uuid": "629a1a67-817b-4438-9049-b8973fb69fda", "value": 83084, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646848156, "uuid": "6d59759a-9230-4778-9ccb-87b8df10f356", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646848156, "uuid": "f71fe477-fb6b-4ba5-b660-3105d6dc7ec4", "value": "edf314142e7d570fc354d7b53437ead0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5c1520f-9f71-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646807234, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646807234, "uuid": "0ce74df1-f99c-41d0-b08e-da3f8ffe0e6b", "comment": "Malware payload", "value": "90f6385f0f3c7b166a3c5ce189eaca52", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646807234, "uuid": "2e6233ce-3ffd-462b-b9a5-8a4d609cec12", "comment": "Malware payload", "value": "3898c926f40490d1795ef7a9b212638369f4f1d717fca8536652df0ee83bd755", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646807234, "uuid": "93724e17-821a-49f6-b8ff-e86142e4a9f3", "comment": "Malware payload", "value": "f6320ada558e41dc3b8268d31655c873370c733a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646807234, "uuid": "cd787225-4257-4694-8cba-0f85fc3f46bb", "comment": "Malware payload", "value": "b1cd935cc730179326abab9c42d2e113fbeaed1b2c30b81bcd22d1bb26364ae966a3ee968cdcaeb37d61b3f2dfba819d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646807234, "uuid": "991994b2-4e8a-4cf5-9293-c6c8c8ec786b", "value": "T139B36AD052C3436FD944E6B1D64E4A84D5CF6A22389A8FCA950E343EDC7E7A1137BC1A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646807234, "uuid": "c031d27e-2bb3-499c-ae8c-a5bc9c5c4ff0", "value": "adb7ee6e61fbfe20aa7cbedd215b526d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646807234, "uuid": "26e6e111-503a-47c0-b444-fe934562821e", "value": "3072:2qQXWDue89k9zr6i8vHI0Qy8Va7bcWbePBv:2qQtaprkv+yb7bH6B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646807234, "uuid": "57820963-9ba1-42ee-b621-215d75f2f91a", "value": 109568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646807234, "uuid": "a6bdb6c7-9a31-4756-bc64-e0868ffee0aa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646807234, "uuid": "d1f0741d-59f0-45c7-b62f-d6321c8dc833", "value": "kkvfd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22ca98f9-9fd4-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1646849400, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646849400, "uuid": "f9802d0c-64c6-45c0-b978-a00b9fb9ebfc", "comment": "Malware payload (Mirai)", "value": "93937e575fe5e7b48890e7d230b777c8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646849400, "uuid": "aaca9791-c4c2-4926-9093-7b47c24ed74e", "comment": "Malware payload (Mirai)", "value": "38e84f8110426f53181a1c7a0a641c0bafb85cf9e722b67335c73c6769bc5eda", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646849400, "uuid": "4684a68e-8d2e-4c94-bb00-f53424004a51", "comment": "Malware payload (Mirai)", "value": "6111e1a33eb115e6e69700027b289712e94b1152", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646849400, "uuid": "b1e78ca3-5f07-4b2a-bb45-e12e57d5eaa8", "comment": "Malware payload (Mirai)", "value": "4fff01a9d670ff53b36d715e00fb00ee8f2ffae07ae82c45fe0c94bcc50e2145957e25025f5d360aa92519920601b6be", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646849400, "uuid": "11672f0c-93a5-4ef9-8322-865762740b34", "value": "T1CA63964D3E319FACFBA8463457F39E10A35823D526E1CA85E19CDA011F7034E645FBA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646849400, "uuid": "06fc9cc1-dc1f-4a6a-a91f-896e109bea30", "value": "768:RzZWyvL5MsRXxPx2pqV2Uzz9HX8iJ3GecFgoSERFImpPxs6vvSp+ozXeyt42egHO:OKzPxkqV2UtGecFgoSWlHs6t0egwsnM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646849400, "uuid": "c9b4f3c9-0250-42f8-9a37-08935df9fece", "value": 71856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646849400, "uuid": "25b1b214-3b9f-4dc1-8bbd-cc1a34722b25", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646849400, "uuid": "3019988a-b123-4684-9753-e8f47ff3d6d5", "value": "93937e575fe5e7b48890e7d230b777c8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c310ece2-9fc1-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646841509, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646841509, "uuid": "341ca480-f491-49cb-bfd5-2dbdbad22db7", "comment": "Malware payload (Heodo)", "value": "c6f9cd36df9003819792cd019470580c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646841509, "uuid": "a83b1cb7-8d9e-47c7-a934-2274114ca2ba", "comment": "Malware payload (Heodo)", "value": "3936eda1a46f69e6b142be2a3ebcf9254c7b6e6425bd13374cde88c7883f726b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646841509, "uuid": "10755625-b1c3-4117-b020-993e0ae2fe56", "comment": "Malware payload (Heodo)", "value": "b5a056b8a6ff6f80ffaf5c0e0607d8ac86736762", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646841509, "uuid": "a341a473-dffe-4a98-b22f-28021c11058b", "comment": "Malware payload (Heodo)", "value": "0c504606b83721a998d025dfc7cfa9241e045dcfee4035b32539cb6da24bdd0e903ed69b2d522966b78e23e532c1eb98", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646841509, "uuid": "24cbedc5-280d-4551-80b9-7efb836903d1", "value": "T1B1257C107E8A817EC71B85B30836676D6FFEAB204B6CA1CB478175ED2D316C29B36705", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646841509, "uuid": "4c68c705-a09e-453f-9a30-7ce2e5de3c54", "value": "087c9809507dfca4c3283e6c7539e91c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646841509, "uuid": "bff03bda-41d3-41a8-bdb5-5d303156aa61", "value": "12288:cR5SOyRHiA6m0OcEljzt6JtcS1j2xKkr:cR5SOrKljzEtcK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646841509, "uuid": "d76009dc-0025-4f0a-80cd-a9ef96ede74c", "value": 1040384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646841509, "uuid": "f4d634d1-6c13-4813-86a9-dda7a28a6cc4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646841509, "uuid": "6ae4f366-8583-4193-b3ff-d3b250d0abdf", "value": "c6f9cd36df9003819792cd019470580c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9715b594-9f97-11ec-9275-42010a9c0029", "comment": "Malware payload (RemoteManipulator)", "timestamp": 1646823396, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646823396, "uuid": "2f9cd559-f535-4262-93de-553b263c8c67", "comment": "Malware payload (RemoteManipulator)", "value": "c13d994d4e79bc6b4c2c6007773ac1e7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemoteManipulator", "colour": "#F73CCE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646823396, "uuid": "070c0288-73e5-458c-93b5-abff2b7caca5", "comment": "Malware payload (RemoteManipulator)", "value": "39fdee94a127b3ff44d985da275c9c843451d86e8b8c4eca28cef62e79cc4c1f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemoteManipulator", "colour": "#F73CCE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646823396, "uuid": "1e0879a8-f7ad-4c38-b40c-f1271d0acc97", "comment": "Malware payload (RemoteManipulator)", "value": "61c31464fb8d31f86619fb679361c80851e42eba", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemoteManipulator", "colour": "#F73CCE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646823396, "uuid": "a7919937-e17d-4829-8b43-24e86a7dc54f", "comment": "Malware payload (RemoteManipulator)", "value": "7059597915d019a770f0895190485626d18152014a6f0eec306d3a7df0950095434f6b54016b7eed7382d066cef76017", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemoteManipulator", "colour": "#F73CCE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646823396, "uuid": "df027c7d-3f99-43a9-aec6-6cbf0dca6383", "value": "T10FC62302FBE58824D8FB87BE4EBE4B14176EBC98561797CD0390B02D5C76341A8A57CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646823396, "uuid": "931d7422-9080-437a-a7ac-d0eea2a71946", "value": "19b321cb7a9ce31c90397152f38b67ea", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646823396, "uuid": "9e74795f-266e-4454-ac2f-7b87dae22f03", "value": "196608:Up9K/ub4vZCrThyfK/n2wWLUxIB86XlXaGrpZpGpFI66Y78n/mVQ/FUFrGc35el:UG/usZA5nNWLoIB8+pasGpUeVQ/CVL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646823396, "uuid": "10800bb1-54e3-4f0e-a254-d633d60abe79", "value": 11477504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646823396, "uuid": "12c902de-78a9-40b2-8968-dea418844d22", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646823396, "uuid": "06179db1-0b9d-470c-9df3-bf50385aca85", "value": "39FDEE94A127B3FF44D985DA275C9C843451D86E8B8C4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7247989f-9fbd-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1646839655, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646839655, "uuid": "21b4120b-953f-43d4-89f0-6e5ec53bc3ae", "comment": "Malware payload (AgentTesla)", "value": "ddd5e84e76fb6d0029ee5cd104df6ab3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646839655, "uuid": "5d5a5426-cef5-435a-b233-a402c8c829df", "comment": "Malware payload (AgentTesla)", "value": "3a3b246763c5c4460927a8f37491ce08395462a14f59b5ab761e05469ae46e5d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646839655, "uuid": "193996b8-f0c0-445d-bad9-8ba2601d6cf5", "comment": "Malware payload (AgentTesla)", "value": "f57b6e5dc06dfe1acfce78770372369cd610f65f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646839655, "uuid": "81254e99-491a-412d-80c5-0ba1c7f57d0f", "comment": "Malware payload (AgentTesla)", "value": "096f92bdb62deac6c55c42362e4842eb52619fcb2319d0d358a6fa1e6596578553f64cc658dfc6cb3d0a8b0c9f7e382a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646839655, "uuid": "62db445d-0283-4f04-9ad0-2174bf924ee1", "value": "T17D8423E64E3C9367F11B5AFE8826AC8179CB1365747283EE9126F2B141DB62C4DCE106", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646839655, "uuid": "2cc0f47c-9819-48bd-8156-f2cedfb45b31", "value": "6144:BWor6rH8Qf2yYW8pdlji3/e/yzUd1FOskKKLxyVmfyXdEWupmb+Ts:BWq6rH8QnYW8pdlA/e/0krkKSVyXdxus", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646839655, "uuid": "ee46027f-f428-4b4c-aab2-b562b11d6eb5", "value": 379819, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646839655, "uuid": "9429e565-482c-4702-b65c-0598e0f717e4", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646839655, "uuid": "938411e1-73f7-4603-961d-1f77be82bd93", "value": "Quotation#QO210421A87356_pdf.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8814786e-9f9d-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646825948, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646825948, "uuid": "6f3de3a8-8a21-4e32-8ea1-974374e77934", "comment": "Malware payload (Heodo)", "value": "9e00f9ea284205cabbbf819aa68ff3a7", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646825948, "uuid": "9ea2ec26-2fd3-46bd-a3a0-f3e035b489e4", "comment": "Malware payload (Heodo)", "value": "3a77185731a8341b13517f028a94c8ead4e1d3a2471c52edbe633e0f3fd24820", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646825948, "uuid": "985e5340-4f7b-4d68-8e57-4f1776ae4c3e", "comment": "Malware payload (Heodo)", "value": "fdbe40f852507ecf07843b8b6a52187a77e5b246", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646825948, "uuid": "676eba41-63e7-4507-b258-3d07e01a3e41", "comment": "Malware payload (Heodo)", "value": "f6c2a0859ddeed5b19e62597102ca909f5575512f431aa15c41f20bd3eddd3dc93b128a22c1b519f7443ebba677ae334", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646825948, "uuid": "8bdc26f4-f72e-4baf-9185-a3a32120d0ba", "value": "T1B423E03CA042FA1CE266797D920C48E6960D21617045A56F3A0C7F6D2B869E70B1F7EA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646825948, "uuid": "fb5faab1-1499-4d19-bf43-afdef3f8368e", "value": "768:zO+CAEWvxRc3mlkKDNWBA7rTj+RYV8Q0RuVBR2jPrtysHRX0AOBAa:z7O2b8QkKDNck01u/R2rZyjtBl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646825948, "uuid": "29fcd9c0-3272-4197-9dd7-acc572d998df", "value": 49573, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646825948, "uuid": "dfca7aa4-8506-450a-9ed3-61058fa52fe8", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646825948, "uuid": "23e9c85c-b55c-4379-bc35-cae6664a77a8", "value": "Notice_751.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "749f9dea-9fb2-11ec-9275-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1646834935, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646834935, "uuid": "434536ab-9e47-4470-80ee-81d0a0ac985f", "comment": "Malware payload (SnakeKeylogger)", "value": "598496bc85252a07dffabb5dd208b20e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646834935, "uuid": "71f19225-47f4-4d48-98ba-9db8ec47cf47", "comment": "Malware payload (SnakeKeylogger)", "value": "3afbeddaa95d7c117934c70ff9d5fe46fcf297960b47eadeb0917ff6e7155456", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646834935, "uuid": "16f4f7ca-5e14-447c-b473-abacf79552dd", "comment": "Malware payload (SnakeKeylogger)", "value": "daa3599329ce970fd46a3de6e5bdaae4f5c7a8db", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646834935, "uuid": "16a34594-e6ba-4e02-bfa4-8414a88be268", "comment": "Malware payload (SnakeKeylogger)", "value": "6c202040ef9ed1e6ee25381963208ae70884bb83b3629b752023e90fa555cd72126739d7ee90dd7c8c7786d7d8735d03", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646834935, "uuid": "3db4ffa0-906c-421a-b39d-24e6aac68eed", "value": "T16CB2E8056294B327C52F46713C729F083666BE30B491AFDB248B3D3EF87319109A976E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646834935, "uuid": "647c21df-f340-492c-8ab8-7686e062e223", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646834935, "uuid": "4c45cf8c-2b6a-4401-bf2a-e69f28c0643d", "value": "192:c+UcCaa6hsKM0hexBdqgzSeHAhh/hhhhhhhehhhhhhhhhhhhhJhhhhhhhhhhhhh3:Bxon0QxBdqgzZk9Fz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646834935, "uuid": "f8389a04-66e2-4e53-9966-ecd110f8d1c6", "value": 25088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646834935, "uuid": "5a9f1b5b-3113-40e0-bb12-6186bb3510aa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646834935, "uuid": "3e637cd1-b25d-4cd9-abf7-461feee06714", "value": "25607510000308XLS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2296dfa3-9f8d-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1646818906, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646818906, "uuid": "bce81303-3f33-4b34-bee9-215f3688eff7", "comment": "Malware payload (AgentTesla)", "value": "a8d54c3325af564c6322bb1130464091", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646818906, "uuid": "2fd65637-1a45-4815-8d23-5ebe898659eb", "comment": "Malware payload (AgentTesla)", "value": "3c5d613bf70b941b4de24a00a4d6f5741d4658e747b08f61ad45ae3957368750", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646818906, "uuid": "23b461d4-d3e9-40fd-89d4-a95ec7216e2d", "comment": "Malware payload (AgentTesla)", "value": "7292678e14df2746a132764f0a5eda2ecff47085", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646818906, "uuid": "97c37a2c-cf00-4abd-a75f-14bef7027d9f", "comment": "Malware payload (AgentTesla)", "value": "f9715bd5b8611c2f7fbe0edcac55124b5706bd411ee824a46f39bd77d46c6007efd718b798e46f37a36758467daa5e5b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646818906, "uuid": "f2966fe2-c15f-43e6-9210-507513074344", "value": "T192B42374E2F8498B9BB2D596E0ACC5FDD70E61488CC19CD49A488880AC1C58F77FD57E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646818906, "uuid": "d4eb5226-6267-43ef-bd5e-bdc9c298de57", "value": "12288:Qgi5P348ufDxrEOD8JjMcE6fTUbzfQhQlMEi/kt:Qj5P348EWOoZMKf8qEvt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646818906, "uuid": "8331e36a-0eae-4938-bf4c-06f27608f93b", "value": 495515, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646818906, "uuid": "9ff1163f-84ef-48ed-989d-56584a3cbeac", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646818906, "uuid": "490e3a8c-7f6e-4b6c-ae16-8cd410402d20", "value": "670071 Quotation.pdf.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e3dbc68-9ff3-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646862680, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646862680, "uuid": "e94add2c-6399-4ff8-8cea-1a09df05b18c", "comment": "Malware payload", "value": "ca1398ac15a63061f802af35a67fa46a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646862680, "uuid": "dad5f8c6-224c-47bc-930e-f359d8304200", "comment": "Malware payload", "value": "3cd44feb937b6607070d01dc056e66fb81ada4c507260c467acecd7ab84ea13d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646862680, "uuid": "f8148ec0-0308-449b-9b1e-2a23110909e2", "comment": "Malware payload", "value": "acaee58f9ba68e1a7daec07b322888bc21632f54", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646862680, "uuid": "fa5f4643-53da-484b-8ccc-9d37906994a7", "comment": "Malware payload", "value": "d1465d9dfcaeae46fc08a4e52731efa4ce3977c6516a3a952ec90e57e9bb9c607db5ffa553bf0b01269e9d726259a1ce", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646862680, "uuid": "7c43407b-182f-430b-b998-a4359234f90a", "value": "T108A49E9966C08E0CC6CAD93BE16B816403C2A7FA27F3DF8FD96B01576E833658E051D5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646862680, "uuid": "1d80d485-ef8c-4488-9f77-9de50d5286b3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646862680, "uuid": "46a23399-11bb-496e-82da-958cc37af8dd", "value": "6144:3J5lflZ2lrRq3qSNU181Qb7+pMLCIYCjcUdg7f56GtA8e1ic0FF0l291NFvEi:Z21A6SN65CfIYPUG6GtAR0FVMi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646862680, "uuid": "1a1f3aa3-ff3c-477f-987f-df443b356b25", "value": 479952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646862680, "uuid": "98392b7c-2114-48f4-825e-a801a4d88f93", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646862680, "uuid": "eacca9a2-ef4b-46a2-b358-b7a629ac00ee", "value": "SecuriteInfo.com.Trojan.PWS.Stealer.32133.30133.32550", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c181a302-9f78-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1646810153, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646810153, "uuid": "bed5157e-2831-4619-af46-cf7563c94312", "comment": "Malware payload (AgentTesla)", "value": "770c777638567d77f6cc9e14c26e341b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646810153, "uuid": "ea10ba98-6aa2-4814-91e2-04d631cad1b3", "comment": "Malware payload (AgentTesla)", "value": "3d62423678d1163d2ef073c7470fca0f1329d47516d318eeaa691eef21b08516", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646810153, "uuid": "dedf6b98-63b7-4e0a-bc07-215462afed2a", "comment": "Malware payload (AgentTesla)", "value": "7bb5f0df3505ef990724156658f27b7c4d611ded", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646810153, "uuid": "eab0fa4a-0a3e-4b7f-bb8c-fda8bbc06596", "comment": "Malware payload (AgentTesla)", "value": "37367047592c157adb23dbbb2352704a53f982e1a37c4784f57d95ec25f9699afbed9dee683a87121b7a83979fbd14e5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646810153, "uuid": "be78e601-8579-4444-9d6e-7dec81010f16", "value": "T1DE52C0E4770B2A6152CF41B2A080E4619D1CB233DF831A7F7552A495D463ABB7337A27", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646810153, "uuid": "0d042c61-7bbe-4a6d-bb4a-a0d0d197d5cf", "value": "384:JLFUSP7kfzs8z60QYxN90lh/6o6rlBkIu8Za:Jdkfzs8xQYxQh/6LRZZa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646810153, "uuid": "d9253cfa-ff48-4225-aac1-3fd3079c3675", "value": 13206, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646810153, "uuid": "db2536ee-89e3-4884-a542-d9d1af0e2f6d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646810153, "uuid": "62c6655f-6ca7-4640-b1f7-ea33563ce46f", "value": "order confirmation 5648902.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f87217ad-9fc8-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1646844605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646844605, "uuid": "8a4e5ae4-2c02-48d0-8c84-a19610b8668f", "comment": "Malware payload (Mirai)", "value": "e1888c43180aec6dc8bab9f44f5c8c16", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646844605, "uuid": "04810989-f7d5-4fe6-a846-f788b27b5c06", "comment": "Malware payload (Mirai)", "value": "3da6018906d427e6b5b488170a176e5880402db539bc1fb3e04fe7625ef9d996", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646844605, "uuid": "c457b379-0a85-4af8-a0a3-621801b0da82", "comment": "Malware payload (Mirai)", "value": "25f0798f9d42add87e0d47665d4d86b5dcf523f9", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646844605, "uuid": "80dd70e4-1191-42b1-9bd2-892828ccf6c2", "comment": "Malware payload (Mirai)", "value": "0725e9bacd5210e58b59707bf28afe14e78ca341a749bb7ef9ec8fc31d5deecd388252c8fe5a506ba0b2a366e969c3d2", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646844605, "uuid": "e54159b0-b721-42cf-8056-30edf1af81b4", "value": "T171633A92BC819A02CAD412B6FE5F518E331623D9D2EA7207AD15AF2037CBD1F0E77251", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646844605, "uuid": "9f985445-66e5-4d1f-a04e-6118ab338b07", "value": "1536:/WloK05nJ7xkC0ztNrB28kQEWwq04MVW84lx1RVvH:/WNY7635qAEfXDVWp3dH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646844605, "uuid": "622c6c23-55cd-4973-ac89-29807d837839", "value": 72004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646844605, "uuid": "d03a3b6a-1a14-447c-9eb5-d5cfc020ca1c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646844605, "uuid": "d160b952-270d-41cb-b4b6-e704711b895d", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ea657ae-9fb6-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1646836723, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646836723, "uuid": "74d23b69-0a1c-41e2-936c-8235d6537949", "comment": "Malware payload (AgentTesla)", "value": "af2ca9d394c1f7a1caa5159ae4ee94a0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646836723, "uuid": "1c36b96e-3fe8-4d38-9143-143e6beb2d02", "comment": "Malware payload (AgentTesla)", "value": "3e49977b05cdec14ba1d373343c1e5f5c3f0c9b9e20e3550c5eb324f76bd7f10", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646836723, "uuid": "77765e3f-bed2-4c88-85df-dbc0dad21d12", "comment": "Malware payload (AgentTesla)", "value": "d92a4b49e08a442bf5cf5ddbc5303e1799bec12b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646836723, "uuid": "d3bc88f8-ff96-4c36-be8e-cbfc52eaeb3f", "comment": "Malware payload (AgentTesla)", "value": "bc8b0acd9403d0862a9c3ec6b81e7be2d37a1a6f8829cccf7041ff29ee2ad866f22b1c022783e8e79527ac2cc75a88f1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646836723, "uuid": "47ecfa58-16ed-473d-a489-904414547d5d", "value": "T1C31412BC7254A352DB398BFC52B5EB42008EADA94EDF48CCA11D32CE1E7553995DA02C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646836723, "uuid": "7f2953bb-45ac-460f-aa78-9f5c850bab48", "value": "3072:W2a67ndqV9ZwFHAQk/wunfaRb2wOcffpHNuUAkxiZ9xaSJ7y07cIuQ1u6dFws:OpwFHNxjlh4UpxK3a+m07crXs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646836723, "uuid": "8f883e3c-6da6-4b3b-b7cb-ba3753d3eaad", "value": 190392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646836723, "uuid": "b4427493-5ffa-467b-8aa2-53da65e46668", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646836723, "uuid": "98719849-3e9d-4024-ad17-2df739a76e80", "value": "MICROWELL LABEL.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33f17409-9fbb-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1646838692, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646838692, "uuid": "82270621-6c30-47f0-bb77-20637300d955", "comment": "Malware payload (AgentTesla)", "value": "feeb595499a446dce05d7dbf329220c2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646838692, "uuid": "ef076812-f29c-411f-a649-b7f5efb22dfc", "comment": "Malware payload (AgentTesla)", "value": "3e8faefcc6870285eb3edc7d05d65af860abf896f479f968c291e4e80725f5a2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646838692, "uuid": "e164cf23-d207-415f-a382-e87d531f27b5", "comment": "Malware payload (AgentTesla)", "value": "dfcad46eae1983570d58823986553796158f6fa3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646838692, "uuid": "ad47f43e-75bf-4970-a06d-b5ff24ac3ea0", "comment": "Malware payload (AgentTesla)", "value": "e68978ba2d0859b7643dd7d6adb739c53f50935c647265eef0c33d2f2bb913d3f1cec51b4fc4ff649f17a8accf60b01e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646838692, "uuid": "82af366e-d012-411c-b708-bcae7524b8d9", "value": "T14635AEE229EF401DF377ABB52FD8F8CE985AEA73151A30DB10911B368523A40DD62735", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646838692, "uuid": "9b913234-7b1e-4230-bccf-2f37eebef80b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646838692, "uuid": "5a7dd948-20d1-48b4-a153-2d5d9b8fb061", "value": "24576:jD5k6upBbzuueu4B4bfDRy/b5wCIWuAkpmrxI29kbI/:jD5kzbPZ4SjDqFR5uAkpmrxQbi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646838692, "uuid": "e2eed702-a177-4708-a703-f08d7bb833d2", "value": 1094144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646838692, "uuid": "5e450c9f-4d33-4c96-8aba-0a26f2860c8f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646838692, "uuid": "a2611d18-3de0-488f-a09e-3246e514df07", "value": "Re AWB DHL 7214306201 Shipment Notification.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "212bb2f9-9fe7-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646857558, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646857558, "uuid": "e296dc5a-f2dd-4cf4-9dcd-6e31b8304cef", "comment": "Malware payload", "value": "305f04c85b752b0a2178d127e394bec5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646857558, "uuid": "1b37d2a2-b9f6-4231-8ffb-78fc62a4934c", "comment": "Malware payload", "value": "3ea76f59faa6728f8a377b86c7571fae53e469077e73d7a36626e13276939993", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646857558, "uuid": "a1c73f1f-58c8-4642-82fe-3caaeb3426fc", "comment": "Malware payload", "value": "0e9f848fbcb4bd15a121c8ada446d2bd5a8b4e2c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646857558, "uuid": "8c78aef9-7820-4801-bfbd-e9690810d8e0", "comment": "Malware payload", "value": "5d1c76d3a4d868468807f0129d332d03a84686c2811c68376a8d97b0d2343139d6c07491300449d48dc0f2481a943d38", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646857558, "uuid": "17cfe18e-62ce-4ac8-a22a-ea3e249107b8", "value": "T1DB648D40BBA0C03DE0B712F8757A836CA52D7EA09B6551CB53D66AEE17346E0EC7530B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646857558, "uuid": "7b10440a-6574-4e91-ae79-d89d57d684e3", "value": "0e7fe55f005b449b96d57439d1b37307", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646857558, "uuid": "081568ff-7008-428c-8709-6e8c8ed316d8", "value": "6144:OXiIV1Wm3MmMZs9WvWihWlCn3NJPvUM/yrvHwctOWqx:+XWm8DZsgvWbC3NNd/yjHwO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646857558, "uuid": "22522ac7-1ce2-4844-8d6b-5755ed15c395", "value": 333312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646857558, "uuid": "88b8e0ce-6e42-4e09-af6f-1f0ef3f11368", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646857558, "uuid": "8ede2590-43df-4a56-a219-5e0364c75c5c", "value": "305f04c85b752b0a2178d127e394bec5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91edd9ca-9f9d-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1646825964, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646825964, "uuid": "4f55bf6e-40b3-4b76-bd9f-14dd43725af6", "comment": "Malware payload (AgentTesla)", "value": "88422cda698cfbb7dd561ae311eca996", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646825964, "uuid": "60cba9ad-c67f-4b63-88ad-7f5cb4a58104", "comment": "Malware payload (AgentTesla)", "value": "4000c86fecd768a177d2a898402a9f1ddd7309f09103ad2acf474f62d3bc0bd1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646825964, "uuid": "ad781ce5-a130-4a7e-8ec2-af66b416bfb6", "comment": "Malware payload (AgentTesla)", "value": "801619a3f25855d3fe143be1eee1bf500ac6565b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646825964, "uuid": "40c77e4d-0ab4-4f62-ab9d-3075b66aca04", "comment": "Malware payload (AgentTesla)", "value": "c4eba7e18b339612834911b7719f98165ab23376fac6427bdb6e48a7d97a226fcef02267d72357643af75bed15192de9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646825964, "uuid": "174b3686-4b5b-4423-a210-1754e9383df3", "value": "T138E4DF6499FBC8FAC83551BEB421C2040E75EE9F5603F7FA500DB838987C7825A99937", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646825964, "uuid": "20953bec-266c-46be-bd40-a35103fcc896", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646825964, "uuid": "f4a83c73-cb7d-474f-8ea9-c78320057b25", "value": "12288:grTXasVtf1YP+8xvyl64kAPfF5xn8zrlgXk3BnicDZ:4TqshYWO74kAnFT8z5gXeBi2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646825964, "uuid": "75b1a08f-b42f-4c6a-89cf-c71c1d35d044", "value": 711168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646825964, "uuid": "64f1c55f-dd53-48a7-8edb-25a5320704ea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646825964, "uuid": "91ebe015-2e80-442b-855d-9d6c13b74f3e", "value": "Quotation.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62483adb-9fb6-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646836622, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646836622, "uuid": "fe592291-552c-4676-8dfe-85aac2783eb4", "comment": "Malware payload", "value": "b03e0f6098a16f0ab208d7b33c17799e", "object_relation": "md5", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646836622, "uuid": "ac7e078b-ce86-45b7-958e-2242b1a936cc", "comment": "Malware payload", "value": "4074e2545397ee74f4073ed9b1161be0ee900ec44b9d6179c3f8198ac247eebd", "object_relation": "sha256", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646836622, "uuid": "c3397378-8d83-4198-82fa-5e705c626867", "comment": "Malware payload", "value": "0f9414753f9f1f2e41469a3f129cdf493bd4a001", "object_relation": "sha1", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646836622, "uuid": "499d5e09-cb71-41f7-ad4f-a96ac9b9811e", "comment": "Malware payload", "value": "f8e617d2891c876a0cfdc8b67d57096a5bcc29d6fd132f9d20e19ecc890e0c0ec2aa827f18b737cbdf55eb81a6bbd9f1", "object_relation": "sha3-384", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646836622, "uuid": "0fa1811b-3605-4653-89ba-f710fc223716", "value": "T12E3412A47A46C0BCC95A47721CE0ABEA7579FC2A4C13930F339DBB6E1E3649D844534B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646836622, "uuid": "12a6b450-0ede-4e38-9447-cb78378139d8", "value": "6144:JNYoD+JyABYo+7NOO9Xw3QnDQQDTUhNa1Cf:JNYoD3ABsxq3mDTUa1q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646836622, "uuid": "15c54b3d-6815-48b4-838c-721e9ed1ece9", "value": 238080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646836622, "uuid": "9e43d777-f11e-4e10-8a78-655c3c7f6ccf", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646836622, "uuid": "3ac04aaa-266f-4c87-b4b3-9aee7154c934", "value": "Payment_Advice_Note-00220803.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f8c3fae-9fcd-11ec-9275-42010a9c0029", "comment": "Malware payload (Quakbot)", "timestamp": 1646846361, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646846361, "uuid": "efc52238-2b35-4c28-bc50-995f66e2829f", "comment": "Malware payload (Quakbot)", "value": "a8b1ee17bc014e7012feb6bab676f884", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama164", "colour": "#6C68A0", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646846361, "uuid": "2469acba-9740-4d06-9822-9301dc0eb66f", "comment": "Malware payload (Quakbot)", "value": "4192d813df909928d3b83a040a14992bc38ac2890d22f3952bfcd164236c7ef8", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama164", "colour": "#6C68A0", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646846361, "uuid": "e74bdeb9-0266-4a1a-9c2b-3cef17dc8bd2", "comment": "Malware payload (Quakbot)", "value": "b4a817b76176ecb024951c50e71aae84a22840b9", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama164", "colour": "#6C68A0", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646846361, "uuid": "39420d9a-2d50-4595-9f99-41a7652c33c9", "comment": "Malware payload (Quakbot)", "value": "cf6f4e883dcbbf4d0d4f093035d407f4cd4a9466eb268656da40e371514a7bc53d8620ada4a9897130144e0b8487f671", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama164", "colour": "#6C68A0", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646846361, "uuid": "444c35c8-6f72-47c2-95e2-e895dcb642ce", "value": "T1CA657E23F2C1887AD4761A3C9D1B739998BA79112D28F4C77AD44E8C1F37A433666393", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646846361, "uuid": "1018c2b5-a38e-429f-b83b-d6e6c9db396c", "value": "cf78a88c4b0403a976a85038ec51a351", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646846361, "uuid": "d6fc8332-d6b7-4b13-9e16-c106d18ebc16", "value": "24576:LP2GXxd5hyXOZk/R8SoMbEYN54UUrW/tRJfJ6OIU2SAHl4XoWSIgX4T:Lu8jI6kcYN9R6iKKgX4T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646846361, "uuid": "08ac8eed-d4fc-4f0c-acc3-bbc695a8fdcd", "value": 1502720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646846361, "uuid": "acb14bf9-6539-4a06-8bef-8db8c423d8da", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646846361, "uuid": "ee6f5302-d9e7-47db-85c9-7fcb1d4d69bc", "value": "7846615.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9546ab49-9fc1-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1646841432, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646841432, "uuid": "224f92b5-ac9b-4cc9-b023-0a7dd40b9f02", "comment": "Malware payload (Mirai)", "value": "78a2156645449824c287dae2f0df2fee", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646841432, "uuid": "02e66aa0-bacc-4dfc-bb95-ea3eb16bd903", "comment": "Malware payload (Mirai)", "value": "41ba1b720ed0137b4e420dcc7412a00d9bd7b6afb93e1cf9a466e14d027c6c87", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646841432, "uuid": "b06a4d4a-fe12-446f-be7a-e9f7c8791e17", "comment": "Malware payload (Mirai)", "value": "ee6100a591ad60c601cf4e2e68805cfb54a9208c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646841432, "uuid": "17d7837b-5196-404d-b01c-d6f89f9799c7", "comment": "Malware payload (Mirai)", "value": "4bb79647a76d15ce23aeeff86be667abf01fc8e905bbdd41f7a1f14423fe89404cb8acb4eef96d8bf37695ef7b143e95", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646841432, "uuid": "90436e33-7431-4459-b503-71e8f377346e", "value": "T13863F846B8918B01C9D512BAFE2E118D331763B8D2DFB213DE105F64778A92F0E7B952", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646841432, "uuid": "908227b1-eae4-49f5-b67b-ccc7b2a0044b", "value": "1536:3hnOaywpK77WJQAe0HSpbDUNvJczK+6giJV1oGa9d2atxlkvL9IkiWLhEZWCe9o:4afp+A/Hq/UTczKdJV1Va9AfLhEZWT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646841432, "uuid": "037a9a8e-3c47-496f-96c5-963d6fac0edc", "value": 71876, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646841432, "uuid": "c985da48-c765-4eef-a686-5a208ba10c77", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646841432, "uuid": "a6867f3a-a517-4925-bae6-c147fad7e732", "value": "78a2156645449824c287dae2f0df2fee", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20f5c6b8-9fca-11ec-9275-42010a9c0029", "comment": "Malware payload (Quakbot)", "timestamp": 1646845102, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646845102, "uuid": "c3489dc0-58bf-4955-954e-39ec707a8fba", "comment": "Malware payload (Quakbot)", "value": "1c327c60b2479db4048ce06314143da8", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "tr", "colour": "#C839D3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646845102, "uuid": "27ba7304-cf62-4dfd-966e-3dfd09126a57", "comment": "Malware payload (Quakbot)", "value": "41e063c24b12f07351c04b48bc566ce98c501d24f500d13d127f94f0d0545c6c", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "tr", "colour": "#C839D3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646845102, "uuid": "15f9e733-5d47-4a7f-9fab-8f72c2921316", "comment": "Malware payload (Quakbot)", "value": "d98c28201ff051f52dbf47bf30bc2acaa06b493f", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "tr", "colour": "#C839D3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646845102, "uuid": "2173472c-bf45-4fce-a15e-d656092af829", "comment": "Malware payload (Quakbot)", "value": "c15f9bb28e827e2408a8dac339e68961381096b5c5649f695c9557968c587acac5a24d48af27cd3926c9ba6343f643e5", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "tr", "colour": "#C839D3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646845102, "uuid": "899c5860-02ac-46d4-95e8-7148417cec43", "value": "T1E0657E23F2C1887AD4761A3C9D1B739998BA79112D28F4C77AD44E8C1F37A433666393", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646845102, "uuid": "a3a546e3-a132-4309-ad8a-1c9f724fff3f", "value": "cf78a88c4b0403a976a85038ec51a351", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646845102, "uuid": "4358af88-35fb-4bfd-bf6b-9f724004d1eb", "value": "24576:tP2GXxd5hyXOZk/R8SoMbEYN54UUrW/tRJfJeO4U2SAHl4XoWSIgX4TQ:tu8jI6kcYN9ReCKKgX4T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646845102, "uuid": "c9d34f02-0742-40ec-96bc-06ddc5c3ea77", "value": 1510823, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646845102, "uuid": "9caef59f-ff21-4c15-aa05-dbacfc7743d0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646845102, "uuid": "937e1e38-b999-45b6-b9ee-16bb0cc383d9", "value": "41e063c24b12f07351c04b48bc566ce98c501d24f500d13d127f94f0d0545c6c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e69e2e19-9ffc-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646866909, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646866909, "uuid": "391f7fc5-74de-4854-a024-b773d0dfa827", "comment": "Malware payload", "value": "598fdadb315cbfe1317617707bc9b5d9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646866909, "uuid": "4ade522c-736f-41ee-8f11-b38e49147fe7", "comment": "Malware payload", "value": "42f948f52ddd00b51cb6a12de8a90ed30a40defa8e30ce6246a4f6fcce100f49", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646866909, "uuid": "f91f50ab-b805-4911-aac5-27e0772285bc", "comment": "Malware payload", "value": "bef32b3046fc3a867a3daaddfcf8d5143448cb25", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646866909, "uuid": "38f6e35a-461d-4083-9b69-fbb535c62dfb", "comment": "Malware payload", "value": "d7cf149b6d02fb92ab40582c09c5d558956a17464872464672fd546e136ab65ce2560b9b1308505ebbcab159e4420336", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646866909, "uuid": "e8e3bb09-240c-47cc-b5cc-b08c27ff35e8", "value": "T1B34633C8A850C7FBF3E91A307C0C8A5934F09D79A8C1BD626F1276CD9FA2261D635719", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646866909, "uuid": "009d444c-10f7-4346-a4f0-eb63af5c352c", "value": "c05041e01f84e1ccca9c4451f3b6a383", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646866909, "uuid": "e2fd7538-afdf-44fb-9360-637a196b4c13", "value": "98304:Je7P616NELrEQD0VUERVAPqSvTTFAk5Zd9kkCrZ++nVGXjw+cg9KbQNei504ioTN:JSP0KELrEQGnuT/JCrZ+fXNJKbQNei57", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646866909, "uuid": "cb248ecd-cf0e-4c02-832d-6aea9c883406", "value": 5830463, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646866909, "uuid": "a5e23975-c014-488b-9f0c-64973c126f88", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646866909, "uuid": "86f4a549-2c38-4c56-887c-6652b739fb96", "value": "i864x__setup__6229285816bc2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c378c818-9fd0-11ec-9275-42010a9c0029", "comment": "Malware payload (Quakbot)", "timestamp": 1646847952, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646847952, "uuid": "695f4a9a-31e7-4813-a290-05f6bd6f1af1", "comment": "Malware payload (Quakbot)", "value": "dbc222c6c405a2e6125d745c74a503dc", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama164", "colour": "#6C68A0", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646847952, "uuid": "18c8865c-c158-4204-98d3-c855085e1838", "comment": "Malware payload (Quakbot)", "value": "432b12d059371f0ab9cf0206bc5dd202a100dcbf79a728daddd84fffce3035a4", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama164", "colour": "#6C68A0", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646847952, "uuid": "039f8169-3044-4be3-b9ab-2f9ca5e2de45", "comment": "Malware payload (Quakbot)", "value": "247e4ecf2bb0ee07c986e1b2e5948584bad09b2b", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama164", "colour": "#6C68A0", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646847952, "uuid": "778c078b-cd7d-4ba1-8711-1a13f018463c", "comment": "Malware payload (Quakbot)", "value": "87b5228da79e99c73c3d5f46cf23bba6a07decf97611169d7511e51c129ca08119e1a11ecaee8cbb915c1e38249f3ae2", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama164", "colour": "#6C68A0", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646847952, "uuid": "7f1e31de-7595-4a58-90f1-fb5dde46932c", "value": "T1C0657D23F2C1887AD4761A3C9D1B739998BA79112D28F4C77AD44E8C1F37A433666393", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646847952, "uuid": "ca611cc1-7917-4f59-a53a-5349d0c4da49", "value": "cf78a88c4b0403a976a85038ec51a351", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646847952, "uuid": "0dd86349-0183-49e0-b495-fbc764482075", "value": "24576:LP2GXxd5hyXOZk/R8SoMbEYN54UUrW/tRJfJrOIU2SAHl4XoWSIgX4T:Lu8jI6kcYN9RriKKgX4T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646847952, "uuid": "0b24e4b1-e4ea-45ef-abee-2d87ede025d0", "value": 1502720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646847952, "uuid": "585e4782-7b95-4b14-b963-33d7612e6c76", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646847952, "uuid": "422eda78-6b0e-400b-8361-7a7275ec9163", "value": "5420766.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d7946d0-9f8b-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1646818092, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646818092, "uuid": "e66114af-aff5-49ad-bc08-c9e9998a80e2", "comment": "Malware payload (Loki)", "value": "f3553a0c20fb31f49c2e9df6e199c17c", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646818092, "uuid": "8597947c-82b8-4867-b7d3-04141efffee5", "comment": "Malware payload (Loki)", "value": "44022aedf54d979ec50560a878b3bc18a30be94b60c16240bc3780feab01eeb9", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646818092, "uuid": "11dd1563-e636-4af3-8877-c1ab8bf049d5", "comment": "Malware payload (Loki)", "value": "1091d12f56a6bdd3ec631cb605339d701c331502", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646818092, "uuid": "cf97f3f5-fc04-4de9-a1eb-ebc9d41e96ca", "comment": "Malware payload (Loki)", "value": "cadf842d24f735b715550c1ebe2d251cf05778dc6bf7bd3a0c4d8a0a01858e7dde53b28dbda7b744954628a44c798c44", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646818092, "uuid": "e7528ea8-b94e-4d02-b309-680de86d458f", "value": "T18814127DE36DF149E8A58F366365530B0A317E310F055262EF6CBB7C28B27511C4B6A2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646818092, "uuid": "193ab3fa-b6dc-469a-b0bb-ad95e537a7b0", "value": "3072:s2VXxWE5z9d1IUKYdGxgqmJ/Br0IvblFOHOgEZu87HB+20P6KIMDEcC+3S+y8j2A:/xWiIUjRqmJ/BnxFKOgEZuhJLBEcCwSG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646818092, "uuid": "045dc22b-5f5e-44c2-872f-654cc817c74e", "value": 190488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646818092, "uuid": "d5978237-7653-4091-b8a3-780a37e21e13", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646818092, "uuid": "cae50e0b-bc19-4068-a033-b5a40ef59d0a", "value": "MV HYUNDAI FAITH-arrival notice.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fe5d7fc-9f8d-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1646819116, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646819116, "uuid": "a89b3ce8-9ba6-4d6b-8281-b53ece97414b", "comment": "Malware payload (Formbook)", "value": "a9d20358c9305d6070260499d8cccdd5", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646819116, "uuid": "38d09b87-0d67-4b99-826c-71b377903bf4", "comment": "Malware payload (Formbook)", "value": "443b95ceb8fa87ba09937fcf08da5bc2a63d7242bcaf558bd3415fe68dde3191", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646819116, "uuid": "165d7a61-8f6f-456d-bf93-780049f06d99", "comment": "Malware payload (Formbook)", "value": "786c7314afdeb410db5a7ea4502dae8dade9d52e", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646819116, "uuid": "85599f74-be06-4d44-9a83-554c2cd5c106", "comment": "Malware payload (Formbook)", "value": "0a0c66b70fc6d074de1611776c4582d887f270253e8ebd036d563450f0ddf365be5325ca9f59ec2eb5188cf43f6b937d", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646819116, "uuid": "0aed580e-8dd0-480f-8076-0bca934d7a68", "value": "T18DF433EEF33927B764896D084F0C827C3B6157CA15B399C80720429255DB7135BDB9EE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646819116, "uuid": "cb646745-0b2a-43c8-abda-a951ccfa5b6c", "value": "12288:EqFf7slCgizv141NpVoxpQHb7HbYiv0SGjWWdmxLqrO8jJuWP1q0nxge:EqFfAlWxENHojok1G0rzDqOxge", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646819116, "uuid": "eb468bdb-b8a8-41ba-9c89-388e3e029686", "value": 738474, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646819116, "uuid": "a04cfe39-df51-4794-9c68-b37a423114c4", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646819116, "uuid": "e9bda947-f8da-4e46-9fbe-e0f5b7c053bc", "value": "PO.r15", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afd442a0-9fb6-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1646836752, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646836752, "uuid": "9991046e-1f4c-47b0-9b73-0c73166022dd", "comment": "Malware payload (AgentTesla)", "value": "8d2e14d4e9fe27e9c5dce2a5255386ba", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646836752, "uuid": "4aeaef24-e6af-45ff-b346-8b41048759ca", "comment": "Malware payload (AgentTesla)", "value": "4449459c4fd120053c9b7a7589602bf4fbb7605fac568dbc1e7d956f6bb12c66", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646836752, "uuid": "e15fb280-10d2-4144-a7e2-cc318deee4e5", "comment": "Malware payload (AgentTesla)", "value": "ac14dcdf1ddf85116b9570e497e9466b76303094", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646836752, "uuid": "d8a6ef39-f2d0-4d00-b334-c5f819e4fc71", "comment": "Malware payload (AgentTesla)", "value": "d052e36f191093d66252d46934599452ee9a524b967919a005ed44a1d2ed6abaf9491fbfd239cda145b72d6a757ef3e3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646836752, "uuid": "38c2ab07-05cd-4cff-9fc8-dec3c2e8930d", "value": "T13325AEE729EB505DF3379BB12FD4F8CE996AEA73160A30DB10511B764423A90CE22735", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646836752, "uuid": "47ade83c-60cf-4720-b31e-2227f907ad6c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646836752, "uuid": "28174ffd-79e4-479d-a480-80b88dd5b0bf", "value": "12288:WXZt3Zy3WD5kPwfb13dzxWJHed3Dtm879CRS5bKAu+zKanusgySE1lqFXI:WjD5kIzzxW1oZm8AU5bSIuUwFXI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646836752, "uuid": "81382ac6-d327-4391-a53c-01f2d8a972d2", "value": 1012224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646836752, "uuid": "46c32d52-c02b-43fb-b6cc-45068922267c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646836752, "uuid": "1c5b8891-d1b7-4e95-8554-1307d98d7899", "value": "Quotation.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26ca2de2-9fc0-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1646840817, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646840817, "uuid": "d307514a-cf30-4dee-926a-8833f191e23c", "comment": "Malware payload (AgentTesla)", "value": "97865ce62c0d2fa864c3e0f9113d2380", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646840817, "uuid": "7af402b2-e313-473c-b31a-1ec51fc3c376", "comment": "Malware payload (AgentTesla)", "value": "44c97db0ad54499a2691d30c00a2c3f33cf7bafde2b30d3bd8a0a63e6b22c6d5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646840817, "uuid": "301601f7-c00e-4a71-936a-f689c136c9e1", "comment": "Malware payload (AgentTesla)", "value": "f9e2c5da309440b057b1db537710ad42caac1e1c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646840817, "uuid": "9d7e2f51-cbd3-489e-b070-25e8cac8c79f", "comment": "Malware payload (AgentTesla)", "value": "dab08ef3e3ab96a69e513b55a4e4f45fee0258f1404d5404a1822c001b211dec516ff1ec37936715cf7b311e1c337622", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646840817, "uuid": "6c6ccba9-dfda-4529-8009-66e46f0b2f73", "value": "T190B4235C2433089ED811CFF275C66E592BABAB114D6BEC00E3E8C8DA5F7C305D6596CA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646840817, "uuid": "9cacfa92-0284-40a3-88c3-65b8de6fde11", "value": "12288:uw6zQODlV0yWzn+TimnijNfRcHVClzdXhrI+k+Q:d6cYV0yWzn+5ni5jlzdXa7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646840817, "uuid": "d4a14666-a717-4848-bdb7-1741dbd8554b", "value": 503541, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646840817, "uuid": "ea743a93-289c-494d-9739-73a90370216d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646840817, "uuid": "6bdd027d-f57e-4e58-9643-cb3cd944f3cf", "value": "PAYMENT.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b5da572-9f76-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646809203, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646809203, "uuid": "67dbd535-157b-4a09-9259-2f803328e276", "comment": "Malware payload", "value": "eba8fadd13e8bc63cf726ad98019ce94", "object_relation": "md5", "Tag": [ { "name": "ElectroRAT", "colour": "#2D2E3B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646809203, "uuid": "8eecb9e9-b604-4e77-9922-5150c00b6985", "comment": "Malware payload", "value": "455b50d805bba086fffaa34e67aba4837e452acd539fe4f98510befbc705ebcb", "object_relation": "sha256", "Tag": [ { "name": "ElectroRAT", "colour": "#2D2E3B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646809203, "uuid": "dce2d2cf-74c1-4d6d-b1b8-eecdf1aa39c1", "comment": "Malware payload", "value": "95179d7a44ff2bf1f692075e7fc5f7ac8271040d", "object_relation": "sha1", "Tag": [ { "name": "ElectroRAT", "colour": "#2D2E3B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646809203, "uuid": "3d69e679-af41-471a-a692-c658c0672ac0", "comment": "Malware payload", "value": "173aa738518d851ff2b2b5eead727aa5bd699302cbbff680562985457c15cbc31e2ad6f1c351cc4a4132bf9f4c327cfa", "object_relation": "sha3-384", "Tag": [ { "name": "ElectroRAT", "colour": "#2D2E3B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646809203, "uuid": "30134b74-2af1-4e08-ae85-d63e3afeb19c", "value": "T12F56339F5F372E50F509AF8F7E203304BB568E0C958B473BAA4A09059F061D5A74CA9F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646809203, "uuid": "3433123d-adfa-42ea-8d2f-e46d6936110a", "value": "98304:mAn+MM6uGV62J08PHEgQsTJsEIJaa+tPeJEs8z9Qg+6s0ne7dN8YwJULN:jVM6uGV62W8PkRLJ7Se0eg+cef3wCN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646809203, "uuid": "e8402e59-5730-48e7-b814-a54126b72349", "value": 6047026, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646809203, "uuid": "245136ff-9a5c-45cb-9f04-1b3ddfa8d6a3", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646809203, "uuid": "d9577df1-9a51-4ca9-96f9-7f45c307240d", "value": "3a413cad-8e77-4257-720b-7e07bc51d01b.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6eafa17-9fed-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646860494, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646860494, "uuid": "4f3671f9-f149-4b2b-9868-68cd869d2c29", "comment": "Malware payload", "value": "fa56b6488a75b401b492ebf3bdd016c3", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646860494, "uuid": "268fe558-9039-4247-987f-33506f79fd65", "comment": "Malware payload", "value": "45c52cfdae75fd116eb42f68ba5e090483f0a4c8b196dab55edb51f1b93b3fd2", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646860494, "uuid": "7181c0f9-0917-4765-b79f-869379d3c80a", "comment": "Malware payload", "value": "ef8b082123a4736ad791278723c719edea7eac8b", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646860494, "uuid": "b4df8c7b-1359-40e3-ba17-c77a43ca982d", "comment": "Malware payload", "value": "19f7d36307cdaad6e009934655b0f56f2bffddd7cc0bcee445a41ff9c0cd292763e9962a0e83a93cf512089aa2856b6e", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646860494, "uuid": "e304b86e-29b2-4092-874e-0e7bc02e5417", "value": "T1E796AD046BF49E23E17FA7F381B0414297F0E45AF363E75B698126B94913B406E1A27F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646860494, "uuid": "d5555cfc-ff1e-49ce-b1eb-5351ff9e614f", "value": "98304:z+4ie3uwfmK3BwN1lNFzAf9xn021g/BDouEtYe5iGBLsgAhyx6fyV4rV:5fmK3BwN21C8Ye57ogr6fh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646860494, "uuid": "651d6899-0643-412b-b98d-f55658b0888c", "value": 9025024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646860494, "uuid": "170ec521-27e0-4a2c-a9b3-2f0f992336be", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646860494, "uuid": "56f402bf-21f1-439e-b434-7ec419a0212f", "value": "bigmine.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "963d8c9c-9f81-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646813946, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646813946, "uuid": "fa558ba6-06f5-4c8d-bec0-afbdb4a518d3", "comment": "Malware payload", "value": "2dd15c0d305242a89a35c8b61e4398ff", "object_relation": "md5", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "nominatus", "colour": "#CFC8FC", "exportable": true, "hide_tag": false }, { "name": "nominatustoxicbattery", "colour": "#130B6B", "exportable": true, "hide_tag": false }, { "name": "toxicbattery", "colour": "#CFE4A7", "exportable": true, "hide_tag": false }, { "name": "Virus", "colour": "#FFCECF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646813946, "uuid": "36c6de4b-3b7d-4bdd-b060-85170b8cb9b1", "comment": "Malware payload", "value": "45e433d6fd0710d2905f21fda25c02fccab9eef43732384f0f0ea65ee464b936", "object_relation": "sha256", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "nominatus", "colour": "#CFC8FC", "exportable": true, "hide_tag": false }, { "name": "nominatustoxicbattery", "colour": "#130B6B", "exportable": true, "hide_tag": false }, { "name": "toxicbattery", "colour": "#CFE4A7", "exportable": true, "hide_tag": false }, { "name": "Virus", "colour": "#FFCECF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646813946, "uuid": "2b9459f5-afe6-41fa-a8ef-d4ecf191659f", "comment": "Malware payload", "value": "d91ae3b5ac290e0687d02605a4a3168823da5943", "object_relation": "sha1", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "nominatus", "colour": "#CFC8FC", "exportable": true, "hide_tag": false }, { "name": "nominatustoxicbattery", "colour": "#130B6B", "exportable": true, "hide_tag": false }, { "name": "toxicbattery", "colour": "#CFE4A7", "exportable": true, "hide_tag": false }, { "name": "Virus", "colour": "#FFCECF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646813946, "uuid": "982b1aeb-55f5-444b-b16c-06d9000e03a9", "comment": "Malware payload", "value": "79c2f03c959ceeea7915714dd981b9183324ed99c74b655382f2651a061c229a0d41137ad3d888652bb9ffed1aae64c3", "object_relation": "sha3-384", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "nominatus", "colour": "#CFC8FC", "exportable": true, "hide_tag": false }, { "name": "nominatustoxicbattery", "colour": "#130B6B", "exportable": true, "hide_tag": false }, { "name": "toxicbattery", "colour": "#CFE4A7", "exportable": true, "hide_tag": false }, { "name": "Virus", "colour": "#FFCECF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646813946, "uuid": "445d7bd6-d2d8-47a4-85fa-c250a5151975", "value": "T11115F12572F44F15E6BBCB7E48B796950973B6C3E832C71A136D600E2B237909B52F12", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646813946, "uuid": "64ba9260-0bf8-41b4-8968-94fa2117f189", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646813946, "uuid": "2cf4edc7-8c06-4726-86e3-663a32cef2d5", "value": "24576:qIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIII:", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646813946, "uuid": "4823178d-499c-4f6b-8cd7-96c52fda20c8", "value": 958464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646813946, "uuid": "949e614f-3e41-46a0-8293-ea735f5141e0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646813946, "uuid": "0f68ca48-5acd-462d-801d-4ccd29179bec", "value": "45e433d6fd0710d2905f21fda25c02fccab9eef43732384f0f0ea65ee464b936", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2098e9c-9faa-11ec-9275-42010a9c0029", "comment": "Malware payload (IcedID)", "timestamp": 1646831709, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646831709, "uuid": "b509bc14-5e60-44e8-913c-05b3c6a35fdb", "comment": "Malware payload (IcedID)", "value": "342b7d3cb193ffd32ebdcab3431595b6", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646831709, "uuid": "4c7e9880-7e05-40b6-ab93-7da8a132e185", "comment": "Malware payload (IcedID)", "value": "46762d829dcf95b5e3fa760a449723b56719e949873eb179eb9013caf124c80e", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646831709, "uuid": "8efb536d-b322-4958-82ed-849d778f4cde", "comment": "Malware payload (IcedID)", "value": "2b223c068ef3221268137dc4bcb2c8909e10ba58", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646831709, "uuid": "bd73a78b-d0be-42ee-8009-78b201a8e822", "comment": "Malware payload (IcedID)", "value": "f30f5ed978e87f760f3b795e845737c170ed3c36200187013213bad9343a733d3c03e12e0695791a0f0c5d101a5d8750", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646831709, "uuid": "054f7cb9-a08f-4356-9f66-22b143a705a3", "value": "T1D3D53307B58455BBC0955171EA032E8E73B6B9210E71CE6EB26C86E72F237E1CE79350", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646831709, "uuid": "2c753fe0-a376-425b-9c35-e2a80d687535", "value": "49152:l3lbRvBoXnBYFYFOXs1CWGbilIJ1iti7koKYxHIljevYyINxGt:llMXBYq1jGb/J19ko9IlqAyIDGt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646831709, "uuid": "43d9167e-9235-4474-8441-85030901e3a1", "value": 2959360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646831709, "uuid": "a60a2466-3986-4d34-bc50-44b1b6d9b43f", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646831709, "uuid": "18fcb40a-4f56-423f-ac50-7ac72778fb78", "value": "request.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "844d4f60-9fc0-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1646840974, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646840974, "uuid": "05d7357e-812f-4321-9256-7cc005c2d268", "comment": "Malware payload (Formbook)", "value": "f331c7025f3a58435180afdaa80b7682", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646840974, "uuid": "77b80867-bebf-4139-bb68-0b7d3d8cd1e4", "comment": "Malware payload (Formbook)", "value": "46998a3acb363a2c5ad5f38658d604c4abd0d52091dd5f65e60468139d1a63e0", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646840974, "uuid": "c6f2ad15-0506-4b98-925d-d13cd3909313", "comment": "Malware payload (Formbook)", "value": "fed5ba08f0f348733ec4477493d220355de32590", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646840974, "uuid": "96a0c961-5d16-4614-af4c-1b3654eb4fc2", "comment": "Malware payload (Formbook)", "value": "cbdc7610caf6e7ba2ce9d5522674cf0f096cd96fb5be0b060125ebf088e4a79196e3f8b37e014a94ab8c0b09d36396da", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646840974, "uuid": "593101c7-e46b-4118-99d0-a6ebefa2bb1c", "value": "T1306422A6ED2B3C2A83C58D46011AE48EB4277A170D43256ABCF5D81477CA7740BECA97", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646840974, "uuid": "8371d0ea-3921-4029-b0f7-b8a53d9aca95", "value": "6144:zXDknxpEUKnfzx1EMNdJirCr0zipyO7Ph9q0na73DFdbE:XknIjnLxGM2rHzKl7Ph9x2m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646840974, "uuid": "396e4958-3902-42e2-ba48-ccec7058c4c4", "value": 330041, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646840974, "uuid": "5ced39bc-9b06-4099-a754-266717dc1c93", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646840974, "uuid": "31c5f11a-732a-47e9-bf36-746d9c4ea2c5", "value": "Scan_SKMBT_00108191399132289118939_09-03-2022.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc0acf7e-9f93-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646821767, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646821767, "uuid": "e6c30e0e-dce3-4465-b36b-76d10507d143", "comment": "Malware payload (Heodo)", "value": "9df254637a000aeca693e47bc4a55343", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646821767, "uuid": "f50ad852-249d-4351-add0-fa8915131317", "comment": "Malware payload (Heodo)", "value": "47459cdea15ece230f32dd15eff253c2117fc310a66efc5379559f1ab0640b89", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646821767, "uuid": "2e145e86-33ca-4079-8810-4798135d0e1b", "comment": "Malware payload (Heodo)", "value": "b82b505de5ea2ecb8ee6adfa6f801f015297892c", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646821767, "uuid": "7584fdc5-2183-4f87-9f0c-92586155c726", "comment": "Malware payload (Heodo)", "value": "75e384b6047e9afe9863d4ee491161b4b7398ceeb78a4b8ee975bc18834885ddec1e7d3f224f268ee8e5b6f3336fdd50", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646821767, "uuid": "32e4e6bf-a06b-4182-912c-5453e5037219", "value": "T152B44C22E151E0B4C21744360607737DE60FADF01B95B277A3B015AFBAB5E71EE26326", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646821767, "uuid": "4822cdf5-1377-4746-a783-0f7355dd3ea8", "value": "c354d2e1bcc359dcb00a22865c038d4a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646821767, "uuid": "e61175d7-bd32-41b5-8f95-abe93e804f55", "value": "6144:TMhEi6lq1EvTzbQJqnoibRcJQfTfuZsIhzED5TJycXo3ZqdK/J:hFGibRYQrCkoko3od", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646821767, "uuid": "886a8fc2-1778-409b-a670-e2da028f447e", "value": 507904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646821767, "uuid": "2e7a9c38-2fbc-4b1d-b2e1-f64169e254fa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646821767, "uuid": "35016b13-ef33-4ee5-8407-fba0d7e060be", "value": "rlM2rzoUMaZjU8.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90040197-9fc1-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1646841423, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646841423, "uuid": "b873a761-ea02-4958-b926-56388a94d0e4", "comment": "Malware payload (Mirai)", "value": "3e22e9a85a6e5c6595b350dcd63b5b71", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646841423, "uuid": "b8558ac9-8788-4343-986a-86632832e30c", "comment": "Malware payload (Mirai)", "value": "47606578334508c698cf9cca5db89f1e501bd079f6fedc3e82ba5b475d7eb251", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646841423, "uuid": "1bccc76f-031a-47b4-a54c-4d45d7086e72", "comment": "Malware payload (Mirai)", "value": "ba732ead9cd38a622a16278c885d4006fce5b6d3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646841423, "uuid": "7c40770d-4c4b-44b2-99a7-202fc76b7c1a", "comment": "Malware payload (Mirai)", "value": "6945c03fa9d55353f6f26ae98835aae0f5f050b7a87168f39acec8fb6601b397b2f7067945b1194810ae5dda48c51c9c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646841423, "uuid": "b51342b1-e564-487c-9a84-1fd0b37c741f", "value": "T137531755BCE28A12C6D423B6FA2E118D332663E8D1DB3207DD215F5137CA92F0E77662", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646841423, "uuid": "e17ec115-e013-4395-968b-d40d1ddcbb05", "value": "1536:UwFla2No6USTZMg6Q4TwfSCyxt5FExTE:Uwfa2NCPEqCebFExg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646841423, "uuid": "27d38f04-ba42-456f-a08f-a31edc23f591", "value": 62280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646841423, "uuid": "0dc427e1-3f99-4c1f-8915-85bf5e265a72", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646841423, "uuid": "1b97b627-e144-43b9-8c38-185b54177d54", "value": "3e22e9a85a6e5c6595b350dcd63b5b71", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08a58dd5-9ff3-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646862671, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646862671, "uuid": "acf69756-4552-46d9-a4d3-b7f063d35938", "comment": "Malware payload", "value": "65d1bbe4cdf555063fb1c14993727548", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646862671, "uuid": "eab9ba09-ff54-4204-a945-96df89afa658", "comment": "Malware payload", "value": "47bf49b62e959618b4fe917fc30a72577a120ef199ec8fcba4dabbb1618f1773", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646862671, "uuid": "2a9b4493-a607-4023-9f31-22dd2708f354", "comment": "Malware payload", "value": "340f952b34e73be774b1b30d6c2e2a5778fc8abb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646862671, "uuid": "1557be2a-0a43-4a6b-8061-ae2eec623408", "comment": "Malware payload", "value": "40ea564c48f20fdee4fbb7c51e7e336def1dc0c706496a8fbd9a133a94323ee9304ff55e7f3c19314819668c8461b597", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646862671, "uuid": "e00762c9-210d-4ffb-8e61-4868c95a13a2", "value": "T158D523E0E754DD42D4BE00B26CA5D03176E5FCADA9D8078CD7E8E725A574932320CFAA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646862671, "uuid": "5a1b5479-e803-4341-8c6c-f7f645680d02", "value": "c0adfe1e9d3803618765228287306305", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646862671, "uuid": "2d539771-9b21-4073-a427-f639ee0cb58e", "value": "49152:2pi3KDPCxHtui8uCZOyXe9xZdizmhlMZuC3ipBpAEMclkONvc:0inPuDZOyu9xZ+3GBpicl5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646862671, "uuid": "ea54a8d3-7625-47dd-8979-91ad3c76e301", "value": 2919504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646862671, "uuid": "abfdd284-7f90-4e3a-aa93-008cc430e54a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646862671, "uuid": "56d14a32-f93e-4d02-80a1-ffee93936ec6", "value": "SecuriteInfo.com.Trojan.GenericKD.39062394.12645.6177", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7d2f0b3-9f70-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1646806674, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646806674, "uuid": "c4cbd354-3b6c-4202-bb36-07816d8eb438", "comment": "Malware payload (Loki)", "value": "11538cbf04dfb79bff9acc20532e3395", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646806674, "uuid": "28003a36-e8be-4535-9129-a97b57f85376", "comment": "Malware payload (Loki)", "value": "47e161058ad21403cb5625f1b959a0678be90977a665f84131db1fe6b25c87a6", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646806674, "uuid": "433e626b-d6f5-4d70-9a3f-3ec2b75f8777", "comment": "Malware payload (Loki)", "value": "d9db520537e2a1a12f599b0775df74969407e76b", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646806674, "uuid": "63b5f7f1-4320-423a-992d-cddb0dddd8a1", "comment": "Malware payload (Loki)", "value": "45ccd59efb135432bfe55b2b2ac59c4fab45ccebd8392922d15a65b7b5c963d5e62c9962f8f88a46d55604adf2dbcda5", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646806674, "uuid": "3dc11e19-a7db-4668-92f7-c55e1aa7873e", "value": "T1E11401B93FAD170FC2DD9E7912B7AAA2D0118DC445B6D427F0297B69C4B3C40F0621AB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646806674, "uuid": "86ea3998-6d67-4a3c-a00b-5393d893174c", "value": "3072:7GDcKneW1I+j5m0eFaXnYXVgw34BlNKYNuxSeN5v0MHgCh3wjGrPYyIg:sckISmmYX2woNKYMseb8+grGrQm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646806674, "uuid": "eaf46193-157a-40af-97dc-7da53821b10a", "value": 191032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646806674, "uuid": "f6604d61-a7ff-4bc6-9a93-1be3602ebb3f", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646806674, "uuid": "d50e85a4-c003-4363-8091-3dec6f98afd2", "value": "Payment-slip33.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9005e177-9fbe-11ec-9275-42010a9c0029", "comment": "Malware payload (Smoke Loader)", "timestamp": 1646840135, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646840135, "uuid": "6646af6f-60fb-4fa7-bf0c-9c6f183f1dce", "comment": "Malware payload (Smoke Loader)", "value": "a1b3d78fcce997d556088a544486368c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646840135, "uuid": "154bbb80-4e98-40bb-beb3-f11b90376ad3", "comment": "Malware payload (Smoke Loader)", "value": "482b3100cc58a2a46a4c3b5bf334a584dee6ebc00ddd810c98cd666a1e1877ac", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646840135, "uuid": "fe9ab1da-03af-41ad-97c9-4b43cd9d29ce", "comment": "Malware payload (Smoke Loader)", "value": "7e5e4b8836555afaf2c965b15257258f06aaa212", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646840135, "uuid": "a9d47f63-70e2-401d-911d-a42df5bedfb1", "comment": "Malware payload (Smoke Loader)", "value": "a004e8cac571c931e27d21f33d935ba964145a1a18ac65f155424e26e4a98f056db2d85a27c984ae64bb4a59480ae86b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646840135, "uuid": "3985eaca-c6ff-48db-a8ce-837755fbc83b", "value": "T13A547D10BB90D035F5F752FC457A93ACA92E3AA16B3590CF52D56AE91B346E0EC3130B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646840135, "uuid": "d135d03f-b645-495b-a0fb-0a94bab619fa", "value": "2eebe0dba96971c51a6bd6aeb0592251", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646840135, "uuid": "639ac355-2b58-4eff-af78-c72d7477bd02", "value": "6144:s+XSLPLS92GvTsvsCJxe1tR9yBcgIqp8ZBmcHhrj1aJf09:RUPLSk0TsvFJCXyOgzp8zHhXT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646840135, "uuid": "4d4f4d21-29e2-4b50-8fba-e1a2c6306fce", "value": 296448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646840135, "uuid": "8010c48c-9616-433b-a8bd-f5155c1a46cd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646840135, "uuid": "873239ab-9998-4c85-a46f-85a30595f3dd", "value": "a1b3d78fcce997d556088a544486368c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5389235a-9fdb-11ec-9275-42010a9c0029", "comment": "Malware payload (NetSupport)", "timestamp": 1646852488, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646852488, "uuid": "6c0c39c8-3d4e-45f0-8584-c16e81c81159", "comment": "Malware payload (NetSupport)", "value": "acd1b50a5aa3e19d23b0c113c72beda6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646852488, "uuid": "860014e5-8c98-4948-91e0-3c088235746d", "comment": "Malware payload (NetSupport)", "value": "48d8e801a917f6d84cb7c144358302402e0f03f8a3667cdbf4be5ad95ec32c6a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646852488, "uuid": "e6cdd2ca-cdfd-45aa-b70e-b9b3c2bcc24e", "comment": "Malware payload (NetSupport)", "value": "322de264874a770b29b4d00eb138c689d7e9bde3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646852488, "uuid": "062f5347-da9a-4a77-93be-c65798e5c9e2", "comment": "Malware payload (NetSupport)", "value": "0ba9d8b8b2a8e1884234ca324ba424efc2b30e6dac939ef10eae7cbf3208dd10a3d0b1b98b6c772ad90bf6a74befdf44", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646852488, "uuid": "ea415b62-4a80-49ab-8b3d-3745863e220f", "value": "T100A523B33D9F30BBEC6523794C98C64A597FEC375951B2168782771A79B010BC312AA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646852488, "uuid": "8268bd59-019a-4efb-a656-2505676ad330", "value": "dbb1eb5c3476069287a73206929932fd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646852488, "uuid": "43ccfa84-2016-41ec-b409-8c8934b94dcc", "value": "49152:i74Nf/PSLuMagmcQRv6UuRygJCNzO/hHxTiPjd/K:i74Jp/TvxKCNz2hHVmy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646852488, "uuid": "e43b7554-2c5a-4f91-aa31-3fefc86fcefb", "value": 2077499, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646852488, "uuid": "77a94399-a832-445e-bf61-9050163ebab6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646852488, "uuid": "b669af51-7408-406c-a5c3-9a4d2eb1a232", "value": "48D8E801A917F6D84CB7C144358302402E0F03F8A3667.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d8b80f6-9fe9-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1646858465, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646858465, "uuid": "63fa307f-72e8-47ca-83ee-e42b1dcd9721", "comment": "Malware payload (RedLineStealer)", "value": "78b1eb91cde373afacb480ea33f95243", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646858465, "uuid": "8062aa49-4c55-407f-a11f-8f4eeb152d7e", "comment": "Malware payload (RedLineStealer)", "value": "49406418e7a79455703cc38b38fdfb08e5ea4bd6f3327556d2549a0e3bea691c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646858465, "uuid": "c28475fd-c14a-4210-af07-e6543ba0cb02", "comment": "Malware payload (RedLineStealer)", "value": "3defa76b90812aa0f1f1a7fa2823811ad7812005", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646858465, "uuid": "7dafaae7-8992-4266-9ae5-53da41bf4638", "comment": "Malware payload (RedLineStealer)", "value": "0afc1ef9703436d12bb206acb365aae18a8a653d5f3f4e847adef7bbe8138c206e54c7f43425dc10c7ebf7ef90975950", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646858465, "uuid": "e9e0ddcb-9071-4094-80d6-0b664ec7030c", "value": "T1B5A34D6973DD4A28F5FE4E7479B1515143F0E1A2AC02E79B4EC4A0DD1E26B80EB12BF1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646858465, "uuid": "6ba0953d-d746-421a-afcd-02a94fa27006", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646858465, "uuid": "aabf9a7b-fcc7-43f0-bfd6-17676ee19c40", "value": "1536:E0DskCruG2IxAbcZnHKuPl9C8FJKX2QJJJJJJJJJJJJJJJJJJJJJJJlJJJJJJJJI:EoCruGMy77CKJgijwHdu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646858465, "uuid": "a9e9fa41-deda-41a1-ae88-e91cd9e15890", "value": 104960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646858465, "uuid": "3db4e30a-f10a-4c21-88cd-b50fd78bfab5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646858465, "uuid": "40607fae-1dd2-44ed-889a-d99ab75cc330", "value": "78b1eb91cde373afacb480ea33f95243", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19cfe8b2-9fe2-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646855398, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646855398, "uuid": "acf4624c-3ea6-4b93-b67c-ef3188fc7bb3", "comment": "Malware payload (Heodo)", "value": "3c20a3cb730563b8362f0032ac1d903f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646855398, "uuid": "12a606f6-6a85-48b9-994b-018fdf575651", "comment": "Malware payload (Heodo)", "value": "495e399d36ffeb5c4f8815915a8b04f485f9dae6aa44b6935c7e3706764d65bf", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646855398, "uuid": "e2932621-abe9-479e-baf8-4ae287658023", "comment": "Malware payload (Heodo)", "value": "1cb3d90e268068fef49b0f16a98c057d19b1150c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646855398, "uuid": "6d1b1c62-3be4-4da1-a1b8-d010055abb38", "comment": "Malware payload (Heodo)", "value": "40c8b801628d20945a7073b27a3ca5f59494b584e335cbc32379f6be3b3fcf8f7bd0e7400be0250b6212ce222a9f189b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646855398, "uuid": "a8113417-f5b3-47f4-94bb-b03f5e7bb51e", "value": "T124257C107E8A817EC71B85B30836676D6FFEAB204B6CA1CB478175ED2D316C29B36705", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646855398, "uuid": "34af2db8-42d9-48bc-8154-c5527c3b222a", "value": "087c9809507dfca4c3283e6c7539e91c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646855398, "uuid": "15a8844b-1774-4162-95fb-7d70287d2c6f", "value": "12288:cR5SOyRHiA6m0OcElLzt6JtcS1j2xKkr:cR5SOrKlLzEtcK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646855398, "uuid": "03be005b-c3c1-48dc-af03-05421b6881d9", "value": 1040384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646855398, "uuid": "818055b6-4aa9-43be-a722-428a6f490bc3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646855398, "uuid": "da0a5ebb-a963-4e45-a446-551e0817fbe7", "value": "3c20a3cb730563b8362f0032ac1d903f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b96e225-9fbb-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1646838678, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646838678, "uuid": "d5e1a4bf-1c9d-4613-bf09-d8432fd26463", "comment": "Malware payload (Formbook)", "value": "647deef7e0f7716f0c4b568e4ed71fd6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646838678, "uuid": "87c9baac-99c3-49b9-b725-c8518f244a4f", "comment": "Malware payload (Formbook)", "value": "49f94b3fbaf875cb2c223cdee59cfdedf4b2b937fba4a473cf2e4f767b44cb4c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646838678, "uuid": "4a6229e4-5680-4b90-b246-8e613fb0b1ff", "comment": "Malware payload (Formbook)", "value": "0d30d09152f281dc0717fb354270ac66dc099b25", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646838678, "uuid": "2e085d4b-ffb1-41ab-8d7c-4f1cab6e2d72", "comment": "Malware payload (Formbook)", "value": "6718605fd1d035bfcc19fa6a3faba10cd3787dbb72f81bc9bc888ef46232fcb78a9767dec47bbfc2a55af1d53d8716e0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646838678, "uuid": "768a43bd-8a10-4fbd-b580-c9a001d92f4a", "value": "T14A25AEE629EF405DF377ABB12FC8F8CE996AEA73251A30DB14510B368523A40CD61735", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646838678, "uuid": "6054794f-bace-4626-a627-953bac908b3b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646838678, "uuid": "9e415e76-94e4-40a1-8c45-a7c8d500a1cd", "value": "24576:zXD5ktf46N8crCTohmQDgHyg3nigNQDc:zD5ktA6NTHHKjN9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646838678, "uuid": "602c2fea-60a5-4757-9fd5-2d5ab26ef169", "value": 1052160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646838678, "uuid": "eddc27a9-54fe-4281-bda9-cf493c883615", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646838678, "uuid": "7aee725b-741f-491c-b406-296c50475e6a", "value": "FedEx shipment Doc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e727071-9fbb-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1646838682, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646838682, "uuid": "fa305412-a93a-45f9-95b9-0a69c88d9ce2", "comment": "Malware payload (Loki)", "value": "a6085466f4c53ceb2e93526a87475182", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646838682, "uuid": "cd4b1c6f-233a-44af-8756-d72b1304d4df", "comment": "Malware payload (Loki)", "value": "4a500a0bea5a68e0d795880a9a7d9f7254ee0695da0d1e0623dc90b720a6eef2", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646838682, "uuid": "230fdb83-bcc8-471a-bf41-aee0ebaa616a", "comment": "Malware payload (Loki)", "value": "87b4a0388be370c845bb27047ffe1c2e87105548", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646838682, "uuid": "27204b11-ba14-49fb-bcb7-4be2668972fc", "comment": "Malware payload (Loki)", "value": "98ee89a27aeb72485abaff3d282a8edf74ee7dbb9c9c17748de09bd0536ba975895ad94d90b25f5392c6939c96296642", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646838682, "uuid": "6f745a6a-45e0-40e8-80e1-b1de66e18987", "value": "T19C259DE629EF501DF377ABB12FC8F8CE986AFA63151A30DB10520B768523A40DD61735", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646838682, "uuid": "ad18b40c-4525-4e92-951e-6ac27e71f539", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646838682, "uuid": "3750d862-cd9e-4ca2-a104-0ec3c59bd5b4", "value": "24576:9D5kNXQ4XS+h7MJoA0sYCaD58Z3F85Rzc4du:9D5kG4Xfh7MoRsxQWjmzdI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646838682, "uuid": "209d7cff-5dbc-4b62-a63e-ce6fd5119db0", "value": 970240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646838682, "uuid": "90863655-faa3-43e3-af06-1f794f049f14", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646838682, "uuid": "92f56b5e-f0dc-45d7-847b-b0cacdc43c55", "value": "DHL 9877482301.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "685c7ac0-9fbf-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1646840498, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646840498, "uuid": "76a7c393-7bd9-48e4-bea8-14a9075fbdbd", "comment": "Malware payload (Mirai)", "value": "0cdb35cd697954fe440af9a423927bce", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646840498, "uuid": "f30fcb3c-956d-45ab-b1e5-d81ab61463c3", "comment": "Malware payload (Mirai)", "value": "4a95e6a25c7679799ff12e70acf03347a9878ff411d208611538dea3e593e9d6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646840498, "uuid": "e3592953-fa7f-417e-a3fd-d142f9b08356", "comment": "Malware payload (Mirai)", "value": "02c4d5a1c277b1db60f2f00e4ded672eb623f0c3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646840498, "uuid": "1a66924d-310c-4e81-b062-67659eaddafb", "comment": "Malware payload (Mirai)", "value": "0f19b63af5b6c4950655e3aeaa26e0b8827de8574d08461701f4ea1425ecf991fd66700b9c3a43d6400d74f340a787d2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646840498, "uuid": "fcfedb64-da8c-4100-968d-68f4049d2229", "value": "T173435CC5AA57D9F4DC0519313077EF3296BBE53B1028EA83E79CA537AD42A02D1073AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646840498, "uuid": "1c99271e-133d-47b1-9d55-2bac4e5debeb", "value": "768:PZVdWbXXvpKlP+lBHGbshRMvd0MK21V6wNlKWdSUyI5cUm+B8Bho:hQXvpKlP+HHyshROSMLFKWoUyScUzB8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646840498, "uuid": "a849b81e-d910-4434-acc8-db19c7aca7be", "value": 57948, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646840498, "uuid": "869c9608-e46e-4a3a-a560-9b6d61571117", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646840498, "uuid": "2d15ff00-1671-4515-aec3-aa13a7de1d28", "value": "0cdb35cd697954fe440af9a423927bce", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af7da35f-9fb9-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646838040, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646838040, "uuid": "f059a970-215b-4615-8716-ae1dee153150", "comment": "Malware payload", "value": "b21053de4824f2d8197cf3deebbcb96f", "object_relation": "md5", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646838040, "uuid": "d4f9df68-b0cb-4035-90e4-1d26363bc509", "comment": "Malware payload", "value": "4b4bcdcc293f734c7504ef54fbc90c4399210a0617a8f25e5c660d5735b1d7dd", "object_relation": "sha256", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646838040, "uuid": "0c278ab8-e9ed-4597-9013-c08fabfba38b", "comment": "Malware payload", "value": "ad538c08df7228628f680302f548eecf6c5a2fa1", "object_relation": "sha1", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646838040, "uuid": "41b3a0f4-c79d-4cd9-b627-03491a0e131d", "comment": "Malware payload", "value": "3171b8961f11387073ec117912f04f55366e03e3f182b5eb18cdc8d7dc03808b30f4605ec9a03a8911797eeeb5bc9fa0", "object_relation": "sha3-384", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646838040, "uuid": "0fa37567-39bd-473a-ac70-e6ff697d1366", "value": "T10DB403AABDF79F7AD61291330BE910E66325C8411F354BC3196C793C39EEEA4394904E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646838040, "uuid": "96c8e107-bd57-4a46-816d-4166f6ecb229", "value": "6144:JK1Tgbyw3sz25o16yN9rjXjIKs2ATlFeIgiEoiTSPN0TMTMxr8b4S0Wu3IjxXp1:wIlgSFPM58br0Wu3c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646838040, "uuid": "891021c1-ca23-4950-afab-3b0fdc1b460c", "value": 542720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646838040, "uuid": "497b3bb9-ae77-41de-90f4-2208c6a1be5c", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646838040, "uuid": "4f91ab19-0f70-4ab5-912c-8caa6430b753", "value": "b21053de4824f2d8197cf3deebbcb96f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4104e399-9fe7-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646857611, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646857611, "uuid": "db132a72-b181-4c44-a805-18d2dc807344", "comment": "Malware payload (Heodo)", "value": "cecf7f0e72cc169e080b9725c396beae", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646857611, "uuid": "c382ab97-a201-4fc3-b917-b1754f23925a", "comment": "Malware payload (Heodo)", "value": "4c293ef0dcf6909960cabbeb9dc895e359ed08af95e911c440b5f7778f539527", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646857611, "uuid": "62803df9-ace9-492d-b652-357c218c8def", "comment": "Malware payload (Heodo)", "value": "3d646281a5a5abd99abd6ebf63fb9a2a166ef6d1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646857611, "uuid": "ae93d9f2-c647-4d4d-a446-89a41614d835", "comment": "Malware payload (Heodo)", "value": "bb23bdc6661267ed696acef113d1c9e2b443c9c1053e4ea7420eeedfcb04815f7f2cf30f32e29e31c995c7ebcd6302cc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646857611, "uuid": "245942b6-3ff0-4cac-8d08-d0d6b0d3b645", "value": "T1BF257C107E8A817EC71B85B30836676D6FFEAB204B6CA1CB478175ED2D316C29B36705", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646857611, "uuid": "9fa5c476-8f51-4ba3-abc8-bca2829f694f", "value": "087c9809507dfca4c3283e6c7539e91c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646857611, "uuid": "2d474c60-3ef2-488b-91f3-72f39d089ffa", "value": "12288:cR5SOyRHiA6m0OcElIzt6JtcS1j2xKkr:cR5SOrKlIzEtcK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646857611, "uuid": "0c59fdd4-c450-4d5c-b1dd-ed44d646f698", "value": 1040384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646857611, "uuid": "68f29caf-c2db-484f-a3a9-e2b972d9e471", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646857611, "uuid": "9daa959e-e9e9-4c54-826c-95fae0db812b", "value": "cecf7f0e72cc169e080b9725c396beae", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83db9e17-9f9d-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1646825941, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646825941, "uuid": "d074ed66-4cd0-4e53-ad36-6d4d00b23834", "comment": "Malware payload (AgentTesla)", "value": "d87ffa64c263067444c0f99c2e1b3438", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646825941, "uuid": "daef9326-ac26-4ebf-b572-0b6c1d82d101", "comment": "Malware payload (AgentTesla)", "value": "4c3aec03b0c64d2101834e5848fc82b41a072d9366561730cf4d6ee1ce40f7d5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646825941, "uuid": "29cd868d-8f23-43a3-97cd-646150f97445", "comment": "Malware payload (AgentTesla)", "value": "b7f13c5431f5c91a2ef2d41323a120250501c397", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646825941, "uuid": "45245f36-bae0-4d1d-a02f-28384a9a2828", "comment": "Malware payload (AgentTesla)", "value": "7824655968b6c0bab00405a9159c7b9eb6c4862032687eb116d212e8093589ace63987f71df644344ec7b6a5b8f1d0a5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646825941, "uuid": "bab545b8-0e14-4060-b6b6-abd1be5bfdfe", "value": "T148B3FE50E94DACD9E7D8C1B3B93A9B100575BBEB92F8819F2265371452B37C320B7D0A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646825941, "uuid": "fde1cf28-386b-4992-b729-5d7f22d04a5f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646825941, "uuid": "56b6b6c2-557d-4e58-8821-e6ed8c7c3504", "value": "3072:zry8o05lhUqrAMgTPA1p8Dja+auDOLQyDl9hFwO4rS6ZQY7j1lQ7wXVA0+4QOv:+Cv14F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646825941, "uuid": "6cd954fd-4083-43ad-9549-1fda5e154700", "value": 111616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646825941, "uuid": "8f61bfa1-3f56-454d-8d9b-fdfbc926ea65", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646825941, "uuid": "ba58af12-34d7-4568-baf1-a8bc8d1e9e4a", "value": "Quote 3879552.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94a1920a-9fb2-11ec-9275-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1646834988, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646834988, "uuid": "78593595-1002-4907-9ef6-74d8091f9d2a", "comment": "Malware payload (SnakeKeylogger)", "value": "5014dff210c5c310bbdc1f7dd9861bbe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646834988, "uuid": "7a56bd97-cdc0-4a38-abe1-4c2aad4c6afa", "comment": "Malware payload (SnakeKeylogger)", "value": "4c3f8da5e9acc5f1bc2c1be021c5497e92069a1af82631336edb81732c99c879", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646834988, "uuid": "9f3c6fff-cc73-4a5e-8e39-efba511cd635", "comment": "Malware payload (SnakeKeylogger)", "value": "13d9426235b7314f31a88bb9757283c27c6f2951", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646834988, "uuid": "d4f46626-7942-4efa-975a-82cfb9b89901", "comment": "Malware payload (SnakeKeylogger)", "value": "2cbb41006d9a97d34bc074c84c44667b2424e201c32305004c4b2ad03a255edecc4a1cb59a4da0a269e8864571e3dc85", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646834988, "uuid": "07365d07-74ce-4c8f-a339-528dbe9cbe36", "value": "T15CE239C6E388D2A5FC9B09325437DE440B1AFF35FD92261539D5B60B8AB328152B331B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646834988, "uuid": "7611dce5-6b29-4de4-af00-d0abc4480fa4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646834988, "uuid": "307f28e4-6220-4eea-844c-271d8cbb768a", "value": "768:BYzObcneLo96qRZmjzYnP7RhRvxRq2Y1rqx0:BQ+cniVyKEFXvxRqHsK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646834988, "uuid": "ddf65ec8-39b0-4105-a4af-261c0743a78c", "value": 32256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646834988, "uuid": "960f0e2d-0023-49e7-8a1f-37993093e536", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646834988, "uuid": "a5cd6d76-f324-4ebd-b080-b42bef185b22", "value": "2bab kk (1).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a617c22e-9ffa-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646865941, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646865941, "uuid": "6603b4ad-ab80-4583-861d-5f109f3d34d6", "comment": "Malware payload", "value": "684bc8d1042872bb81124b5b666ea23f", "object_relation": "md5", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646865941, "uuid": "1967c681-80e7-4bbd-9059-3e83951b3027", "comment": "Malware payload", "value": "4c5036abb8ff8a6a5066b99a5dc96bf01c4482ea713cb254fc00855e1eb7598d", "object_relation": "sha256", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646865941, "uuid": "9416536c-2732-4971-972f-b3e46955179e", "comment": "Malware payload", "value": "29760d6fd710fbf53d68936f936e4f4b3b47a381", "object_relation": "sha1", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646865941, "uuid": "b03ecb7e-d726-4d2d-a38d-a2ef58dbf330", "comment": "Malware payload", "value": "1628f19f19ca99c462cd5d46c62e49a3ae9cade1cd0ce070847fba0c55eec0969ec47397f76aa32d3ae16ba49633a090", "object_relation": "sha3-384", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646865941, "uuid": "85cf5a8c-8831-42a4-8cee-ac4e65e4dd05", "value": "T17613D02CE65B3119C6359C7D561CDCF56E0821975409DA8B2848FBCC2EC1BF722AF19D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646865941, "uuid": "981904f1-fb73-4c7b-930f-c3f275bf52ac", "value": "768:1CToSyUnZpOw+pyZfQCwBzii1H/KNsH7meB1Id5qXkm1qVw0je7:1QsUZpOw+pyZfQCezfCNRejIdcXheRj+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646865941, "uuid": "432aa256-468c-43b3-b195-bcf9c239afb0", "value": 44632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646865941, "uuid": "f124ca12-7720-48a7-8ddf-31968174165d", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646865941, "uuid": "14d56085-aebb-489d-9923-ecdc1b1a3832", "value": "Datei 7563091663.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "569ce867-9fcd-11ec-9275-42010a9c0029", "comment": "Malware payload (DCRat)", "timestamp": 1646846481, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646846481, "uuid": "d1457bde-6087-4c9e-bd95-a85ac78cd1a6", "comment": "Malware payload (DCRat)", "value": "31e19b04d9b0b92d7ca4549b8ddeb970", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646846481, "uuid": "cae157eb-5907-4673-8943-9090f7e8ca82", "comment": "Malware payload (DCRat)", "value": "4cbccf95c51f5cd84021e5afba34f507411d2a6d00d30f3223e18c298ecdd3a6", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646846481, "uuid": "6195546f-46ef-4382-b86f-5144fc0c2c5e", "comment": "Malware payload (DCRat)", "value": "6a85e7298a154403c69b66f98b27c66980b4ffc7", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646846481, "uuid": "8ef7ac45-3cc4-4431-a41f-430b0776eaf4", "comment": "Malware payload (DCRat)", "value": "066ed3fc9ef2285abf4aad0ceb9305d47d57874182880d44a315973c33288324f04f486f8951e71403ee14c54d366ef9", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646846481, "uuid": "37be8f45-9d7d-45f8-aed2-3e68ee5461a3", "value": "T190B5CF027A84CD12D06A1737C9EF851843BCAD427A62E71A7E6F37AD25213A70D1D6CF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646846481, "uuid": "f45b08bf-0d8a-450a-80f0-dcbaaf008433", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646846481, "uuid": "88fee5a8-ad1f-4bc7-9d9c-d364004fdc07", "value": "49152:LqNCYJ28G0lqUZimRWicsaGAAjYBw/zzbOfFctNzAyHx:LqNrJ2QZiiWicsaGIBw/zzKitpAy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646846481, "uuid": "86a5f07f-cdba-4b79-b6f6-5dab15141eef", "value": 2454528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646846481, "uuid": "e01a3f1a-a734-4691-8bfb-a9686fe47f06", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646846481, "uuid": "6c5d0fa9-7187-4199-95d7-4478fe14d70e", "value": "4CBCCF95C51F5CD84021E5AFBA34F507411D2A6D00D30.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2819bd57-9fe7-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1646857570, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646857570, "uuid": "ccf6b222-29f3-4a7b-b40a-11355a3f65e7", "comment": "Malware payload (RedLineStealer)", "value": "b16c9f7009407f65805b7b4e5259a6d9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646857570, "uuid": "925fb9e9-e006-4a95-9d4d-f490071de9f5", "comment": "Malware payload (RedLineStealer)", "value": "4e3d0dd4c21c802612c6c3d8bc4ba287c0def0990da61806c232ae7f9c207e2c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646857570, "uuid": "2b5fcdcf-f521-4e1e-852b-966c948d8222", "comment": "Malware payload (RedLineStealer)", "value": "d4f026f0ac430daa7b233b871551683765a1bac9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646857570, "uuid": "8c34571e-35b3-4588-88fb-080598582cf4", "comment": "Malware payload (RedLineStealer)", "value": "3ead32346a3c6805393d87bffce53cb4efb142cc02a7d70c95d0005d024e0d04a5f30c82f56555280ff593ee975d9267", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646857570, "uuid": "54c87169-e408-4716-a19e-9a3b6e34a31a", "value": "T124B423163AC5F269DDE17FFA9A76E906580E1C031CCD82361F08BC6E6539A7CB68C54C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646857570, "uuid": "857b0d5b-2df4-405c-acb3-ffb6b508310b", "value": "04458f7d0d12a5bfd997438503c0380d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646857570, "uuid": "00c85d7d-d464-4168-ab93-660a34b6fee2", "value": "12288:ZFUClIa1h2pikNmHFTK/lGRgOUqmq9kR6lhKXRlAI:ZP3j2MkN6FTK/cRgOnmq9g61I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646857570, "uuid": "030fab16-fa32-4cc0-8f7b-5863f19e260a", "value": 528384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646857570, "uuid": "1c19ec3b-9266-4034-adf9-eba7d2f2e0b8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646857570, "uuid": "df9855b2-538b-4f6f-90c6-4e249a240bf8", "value": "b16c9f7009407f65805b7b4e5259a6d9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b59bfa2c-9fdc-11ec-9275-42010a9c0029", "comment": "Malware payload (BitRAT)", "timestamp": 1646853083, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646853083, "uuid": "842422ed-def2-40fd-8ab5-b477487e9f8a", "comment": "Malware payload (BitRAT)", "value": "adbb1af7661813a76c85b6ce8d5dc97b", "object_relation": "md5", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646853083, "uuid": "cffd2486-6c6c-4b25-8966-765fb286e19d", "comment": "Malware payload (BitRAT)", "value": "4e6dd147fe163628e5d79043ab25d1bdca930dfd5cbc5ca77bb345702590f199", "object_relation": "sha256", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646853083, "uuid": "32ebaa9d-abe4-4c67-b186-12fba1a202e5", "comment": "Malware payload (BitRAT)", "value": "570400413e24746fe4942bb5d32f4ad1b3a9888c", "object_relation": "sha1", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646853083, "uuid": "4501e007-9a60-46b7-b538-df3ea5d1b1f2", "comment": "Malware payload (BitRAT)", "value": "c7f03c5143b6acabbcd4e96c1cc999c6367743d4803010e8cf6980691c2f7f0e5fb74ea87ce19c16ef706ac0f54026bb", "object_relation": "sha3-384", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646853083, "uuid": "47616028-01fa-4b20-968c-e367c36d9f16", "value": "T17A920A1D23A89773D2BD1BF518A211101376A17768A1EF196CD8A0DE5EE7F0881A3F4F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646853083, "uuid": "0dc914d5-a2af-41c0-ba12-19c895e4e983", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646853083, "uuid": "6d9eb916-7417-4047-9d7e-ef9c9f394832", "value": "384:9jmf/6Z3lFmHluLRDQauN1e5pBuBsD5zfffFLBZ:9qIuUI1KOsff", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646853083, "uuid": "689c5bbd-9a68-442e-8dce-dbbb24238750", "value": 20992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646853083, "uuid": "5c23d907-0bb9-4981-a07c-4fa73c5ee642", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646853083, "uuid": "b677d5f1-c060-4c94-971e-4816424bc4fb", "value": "adbb1af7661813a76c85b6ce8d5dc97b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c3ee184-9fbf-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1646840397, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646840397, "uuid": "e279b28d-ca78-4976-975d-0f42c9fff0a7", "comment": "Malware payload (Mirai)", "value": "d05d18af614ea0591fa7b3c9f95c0ffd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646840397, "uuid": "ef036597-67f4-4091-82b1-431b1c8fd46d", "comment": "Malware payload (Mirai)", "value": "4f52240bb3989ad2ba4013b6bbab9cf2c5f98a700f39c575417aa9e02e68672f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646840397, "uuid": "52a224d2-0ebb-4ba6-befb-117d7d13a58b", "comment": "Malware payload (Mirai)", "value": "5e60f30992bd75f2f9bbc14bc7955e9ab1e7e443", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646840397, "uuid": "a35c283a-c06b-434e-98b0-48a39592c114", "comment": "Malware payload (Mirai)", "value": "d9e266cd38bc5d5d3214ca8563585673e5828a1a6d292271500c2ce15bc8d911ad6c6e49d861e928edc89be43d64ed1e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646840397, "uuid": "acf8231c-b4d3-447f-a6c2-60e143cd09ff", "value": "T1F5B33923AD564837C5A5B53651FB8370F0B282C930785F2A7D630D8EAB35B162673FA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646840397, "uuid": "5f17130e-340c-401d-bf0a-5cce911ba4f8", "value": "3072:okuHIKlw5axyCDM+QTAZSFozC1d/ocwiQTKKx4F7Bm/8TgzWh4N8r4Twphah3:okYw5axyCDM+QTAZSFozC1d/ocwiQTKW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646840397, "uuid": "0e63e6f7-f368-4924-94b5-77348377a6a3", "value": 110932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646840397, "uuid": "f504d13d-4b96-45da-8235-09bcb529c97a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646840397, "uuid": "df274d12-c92b-48fc-95cc-d0ebb946d0ee", "value": "d05d18af614ea0591fa7b3c9f95c0ffd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35a3c489-9fd1-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1646848143, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646848143, "uuid": "26064941-e0de-4e02-a746-19b72d4e0292", "comment": "Malware payload (Mirai)", "value": "dbc3110a05b16853e04837c7a96f2c0e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646848143, "uuid": "19a304fe-e70e-4ffc-907d-035b96006672", "comment": "Malware payload (Mirai)", "value": "50e229828ff8f893c8490621e859281ceb03cf359d4c15c519572cc72869a1cc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646848143, "uuid": "d60eaf4f-8eb9-4b8b-96ae-047fe96b92ca", "comment": "Malware payload (Mirai)", "value": "4e27c39c8a410781562050cf1297ffda7fa26557", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646848143, "uuid": "56ff6647-f649-499a-9653-6a85ff270414", "comment": "Malware payload (Mirai)", "value": "b458357a2bb435aa2548163b85296ffc5ffeb7537054c30246293750c4fec7af79b59140de0685ca1eb077d128b9fb0c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646848143, "uuid": "9da01357-f474-49ee-94e9-a9a97f89ec59", "value": "T170435CC59563E9FCDC1019353077FF7656B6E93F1028EBC7D7A8A932A981A02D80728D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646848143, "uuid": "46b98a84-8686-4379-8987-a402ee932f8e", "value": "1536:36Ew7hWCbZ6OzptrGP85wXyRGWTF+bt+Rc:C1W4Z6OzP4NXyRGWp+bQK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646848143, "uuid": "849663d2-b151-408f-b9ad-2e367af6bebc", "value": 55872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646848143, "uuid": "ba6774ee-cd4b-4759-99b2-63bb7c0e0d68", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646848143, "uuid": "190338a6-cace-4bb7-8f29-a46584b8668f", "value": "dbc3110a05b16853e04837c7a96f2c0e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1015493f-9fc3-11ec-9275-42010a9c0029", "comment": "Malware payload (Neshta)", "timestamp": 1646842067, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646842067, "uuid": "22ea71c6-cac5-4cf8-9012-44b7b0db2fd7", "comment": "Malware payload (Neshta)", "value": "02ee435dadf8550dccc320de47652869", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646842067, "uuid": "dbe6126b-a3aa-4ed9-a8ad-1a23a1de547a", "comment": "Malware payload (Neshta)", "value": "52701ab860194c1e24d9b820a6595d741329f7effc2bc27a8cf5e8263a36f055", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646842067, "uuid": "bcbb9353-fb81-4bed-8a44-3f05aaca4a67", "comment": "Malware payload (Neshta)", "value": "9946fb7fc6556f114502f144445306c0fab48ec2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646842067, "uuid": "09634d81-7672-4d26-8225-8c7ddf3039a0", "comment": "Malware payload (Neshta)", "value": "985e23b7bfb37996df17e6b4f59eff1178d5c3ba6b823dd58467996755a0d01ffa537107719750fa57a3142268605ac1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646842067, "uuid": "cfe228d1-3ea5-4eb5-9ea2-bbe0bcaaec04", "value": "T18EE46B9C7B492A5BEF901AF259A650063E203B5CA1CED2312E8EED50F0F2C75597436F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646842067, "uuid": "75b04d5e-7333-4da4-971e-f879f10ae149", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646842067, "uuid": "6f47c019-695d-4273-b1dc-793ebedbadbd", "value": "12288:shped5gTNTYJQkepZTqS+RFOkGY8OsKqc/okZ251bfNf6iFBq/jsQW9UY0RF:MfTdYCpoOk/8OPh/okg59fNfNq/4QtYM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646842067, "uuid": "42c257da-45f6-42a1-b4c5-53404c0bec04", "value": 720384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646842067, "uuid": "d98e9683-4f41-46ea-b404-caba36946786", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646842067, "uuid": "68fe5d0c-5871-460f-82c2-6e7dfb34ec73", "value": "RFQ-20531 QUOTATION.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "128b461e-9fb3-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1646835200, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646835200, "uuid": "a8c3762c-66f4-4a69-b896-d0ff755fe906", "comment": "Malware payload (AgentTesla)", "value": "dd5e0301423e5ebafc560463f25d00d3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646835200, "uuid": "052eacbd-e0c0-4532-9258-ac4126261d31", "comment": "Malware payload (AgentTesla)", "value": "527444ab37ecf1150ded345e584f3a6fd6150fb1dc17cf6ba6dd7567233f455f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646835200, "uuid": "568fe0ad-d637-4ffa-a89d-a5b9de53c289", "comment": "Malware payload (AgentTesla)", "value": "071c4f4c12442bfd0a1d5226f874e883a467cac4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646835200, "uuid": "ae57e570-5f38-41b9-b465-010cb8b9b32d", "comment": "Malware payload (AgentTesla)", "value": "a5834755c879a1aef02c3b4ea754d33bfdb23f9e5b64426ad8a9a7c3c11446bb93efb602b943fcff90d5f7406c3bc6ba", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646835200, "uuid": "9115ce4f-9e50-4f5c-97d7-7e6f711e01ef", "value": "T17F25C00059EA503AF52A6BA91BD0BD7759D7B96E1014E0BE2C1CCA844FE077C9DC1FB2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646835200, "uuid": "619c1569-53f5-47bd-80e3-ba36d06fca5c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646835200, "uuid": "21d62eff-f9bc-41cf-ad25-4b3cfdbef8be", "value": "24576:BSSfv6NgDS8tA8CogNb9CWEizXXTe2PXIfJP:B4wfUocb9CWEoTe0XIf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646835200, "uuid": "fd6cd125-451e-47bc-aff6-0280d2407d5d", "value": 1045504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646835200, "uuid": "592a499f-6e50-4181-aba7-ab3650d06572", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646835200, "uuid": "eb8f3a6c-c27c-4720-9ce2-9814b97914bb", "value": "AWB. NO.1603915025.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d581a794-9f71-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1646807180, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646807180, "uuid": "d513e021-6e0b-4d9f-b90b-f394a361e9c1", "comment": "Malware payload (Loki)", "value": "d685192d887aad360ae65cd7cdba758f", "object_relation": "md5", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646807180, "uuid": "97931be4-d001-46ef-a902-39bbc6f07b6a", "comment": "Malware payload (Loki)", "value": "52dd3472a095921e25c59a1c903ab9b5c51ea64e09ef777c9c264f9dcd9cab07", "object_relation": "sha256", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646807180, "uuid": "c1768634-3730-48d7-9822-59811ae8de29", "comment": "Malware payload (Loki)", "value": "988da3505f6a2494509aee691f012e09b91f9fe3", "object_relation": "sha1", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646807180, "uuid": "4a3f5700-e23a-4cd7-a282-a059e0aeab4c", "comment": "Malware payload (Loki)", "value": "eeb916a59c143e86d49f4d72f57ab0971c53cbafb097a895d583e787fb15db88160df5c4819676b2263d47dab5d78b45", "object_relation": "sha3-384", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646807180, "uuid": "9b383218-fc25-4c07-a3f6-04a9aa5b536d", "value": "T14AD4336A1C70DA391E5FDE28E44A68D81425D8348F04EDAE3F4B985C3CD2589CEECC62", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646807180, "uuid": "f4ee475a-2e36-4702-8a09-e1c08ec9030b", "value": "12288:Kc8LTVhlFLuX2U29xYLnGmjdoBgSerUcthrb+q5yvv6gHJUM0b61+:N8LTAL29xYLnfbUCR5yXLeM0x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646807180, "uuid": "befb671c-c6cc-4b46-ab70-c1cb3e9530ad", "value": 636496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646807180, "uuid": "bdaf5c37-a845-4c61-818b-a57f3acd4cbf", "value": "application/vnd.ms-cab-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646807180, "uuid": "d831b90b-8519-47b0-97bd-f370dff0c733", "value": "New Order.cab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3fec418-9fbd-11ec-9275-42010a9c0029", "comment": "Malware payload (RemcosRAT)", "timestamp": 1646839846, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646839846, "uuid": "0bbd28e5-1dc4-42c3-b884-27886ebb218b", "comment": "Malware payload (RemcosRAT)", "value": "c4038a129f903e7feb4fab2953974454", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646839846, "uuid": "4751d55c-46bb-4f83-9756-d39cdb0ef7e6", "comment": "Malware payload (RemcosRAT)", "value": "535875e408bbb344d35c6423d432b6886cd348199a62435ba313c21fbc0a7cc9", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646839846, "uuid": "a20bb020-fb91-44a0-80af-0b81238b6fd6", "comment": "Malware payload (RemcosRAT)", "value": "9501babacdc3bc54af8eda093a28a34b9ae2d384", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646839846, "uuid": "6669e7bd-94c1-436a-baa8-bc26f57896f7", "comment": "Malware payload (RemcosRAT)", "value": "9f6c8da0b476927c46b708e679048e2ceb4a525dff6d93da7bbd501f2b3e63b4fb1dbc61d69b1e958613ac31d4b207dd", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646839846, "uuid": "5f4b54a2-24dd-4455-a939-0f8bd8d131ca", "value": "T1E665AEEEB7901832C1226A398D6753B46419FE112F10A4873BE87D0FBFB55517A393A3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646839846, "uuid": "469dcd68-191e-46f2-8006-315b621c8926", "value": "12288:ePMS5rQMPN376hkPire9wd2rUnyMRZv5YDQfzl/WRIlRfkKOOikh:QMsld6hkie9wdFnDZv5Ymht7f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646839846, "uuid": "b19fe2af-5642-469b-a343-9a0d0056b165", "value": 1507328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646839846, "uuid": "a6d2435d-3bb9-48bd-aebf-b3761b9e1fa0", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646839846, "uuid": "c80fb9f9-a902-49b4-9b0e-a54fb308fac1", "value": "Attachment.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b3a18dd-9fd4-11ec-9275-42010a9c0029", "comment": "Malware payload (njrat)", "timestamp": 1646849468, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646849468, "uuid": "383655b7-26f5-4743-a2bb-4cbe29baee55", "comment": "Malware payload (njrat)", "value": "77cf05f296b4969aa19d17114d1814e7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646849468, "uuid": "2b258828-9ff1-42ac-aa1f-e1f843bcfec8", "comment": "Malware payload (njrat)", "value": "53777546c28cb8912525bf2f3f0e7a69e29f61755b82cbba7d1a0c0d9c562536", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646849468, "uuid": "4aed7755-baab-40c9-b17e-7e19baf8f2e2", "comment": "Malware payload (njrat)", "value": "47526e397ec70a77cb5f5b920e5b1cc4a84f7595", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646849468, "uuid": "7d8ae5eb-e90c-48fb-9d6a-973633bab29a", "comment": "Malware payload (njrat)", "value": "25201a85a3704fcb07a778ba8bc82f8240b00942f0a2a116a0b39bd7bb65854e22e956417c227d3ce32179613524a14d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646849468, "uuid": "9f8ca273-56de-44f6-bf79-2b780612ba87", "value": "T17B752342BDC5C5B3D82109355A39EB51A93E7D301F108EEBE3E5A92E9A350C17738A73", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646849468, "uuid": "e2619c9d-6e73-4583-8777-68a008fc9475", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646849468, "uuid": "9f52835c-4944-4afd-9f3f-83c2e28d8c01", "value": "49152:WeSg4AV+vq4F+Q5Rl0+0DGw1f6oQcyt7FsL:WZGV+vq4MQWvBehRC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646849468, "uuid": "7c3da299-5640-4fe4-bef4-2f9f615a171f", "value": 1619832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646849468, "uuid": "3ab26015-f145-48f3-852f-f19289b3bec2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646849468, "uuid": "65658fbf-8c69-4be0-b4de-5a56b2d24f7e", "value": "77cf05f296b4969aa19d17114d1814e7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "681b5a1f-9f96-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646822888, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646822888, "uuid": "a4d77910-1c10-403e-963d-323394535c7a", "comment": "Malware payload", "value": "74a0a81c0528b4327cd0e58e0ed2ae17", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646822888, "uuid": "5a1299a5-2bdc-467a-b1be-d1ff75c692fb", "comment": "Malware payload", "value": "53a27971741b36c84552a32aa333c931f989f855f9e6c8c2a68ed27eede6c57a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646822888, "uuid": "a5879702-f11b-4b92-888e-b0ddcf2ac164", "comment": "Malware payload", "value": "8ae4f370ed2f229db909430475e654310682e50c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646822888, "uuid": "61f490cd-13d9-4256-a655-85c7545207c6", "comment": "Malware payload", "value": "506c5c99ca139b188a2796c720bb78d4f686da0b0d934c12fc7623a975b7d9954f5952a29870036fe2c61255437abea5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646822888, "uuid": "219fb0b7-cc6e-4a2d-81d9-6055492796da", "value": "T101332B02B5838033F8DA11FFD9F959B5517CEB70CB2D22F352CE55BA2AE01D62439686", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646822888, "uuid": "db68a778-990f-4676-a392-c0d6e880e9d6", "value": "fc56f997f3dfdc5c95b5197e7e987a41", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646822888, "uuid": "b3653ec9-ae72-4c1f-92a4-d5980c4c811a", "value": "384:OQllep0CW2ZHq9XArjEEBJ3wfYODaAwPhoLpDgJB2D23YZj:hlaXcXwjEEBJwFKhqpEJB2Dr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646822888, "uuid": "82058f5f-77bc-444e-8604-3965c7fdfc31", "value": 50176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646822888, "uuid": "9a3564a2-69d4-4b32-8c0f-44659a68c21b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646822888, "uuid": "8ceef0ed-a320-48c2-abe3-0b7de15ceac3", "value": "zalgEXE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf35feb1-9fda-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1646852266, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646852266, "uuid": "d624bb34-712e-444e-8be9-cadcc32a5550", "comment": "Malware payload (Loki)", "value": "04767fec2e8a82c4bf972a56b8650be3", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646852266, "uuid": "22409038-cd32-46fc-8719-5d284af5a327", "comment": "Malware payload (Loki)", "value": "53c0f1c39bfd14e272987800ef423c7a5c1a007956a2b74312e28edecc6b86b8", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646852266, "uuid": "d0dd2119-f6f4-45e9-a97f-ea804a3b4e77", "comment": "Malware payload (Loki)", "value": "64e376c8741b1d101f116554ecd11cc1916d1e17", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646852266, "uuid": "32b906b1-b454-4d0d-9011-fbacb1f8eba6", "comment": "Malware payload (Loki)", "value": "fa0f488f6d16beb284a333c23ccd68563d1a0b008590c4faa6897f5710bf2ca3280b20c504bb89ee179d2be213d83eed", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646852266, "uuid": "a498ed95-6e54-4377-858e-425e877accc4", "value": "T1A10412476412FC65C922A9BCC9269015E280BA0CD4B5C11D6170A3FFBBE92DF5F97B8C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646852266, "uuid": "67b5b906-4aac-4040-8fa0-d0a36775778a", "value": "3072:xTFYRDyEsfM3jQ29jH2tYiUiL4z3o5q1mTBOQvqmL7AaQutBguM/xSVFW6h+g1nt:xTeRmoDNMRUiLqx1gB1SaBI9/2x1ngMp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646852266, "uuid": "a1e45b2d-751c-4bd8-ba00-98b3cb1f2c34", "value": 184606, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646852266, "uuid": "3f1c4853-fa21-41fc-815b-94da6def1b94", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646852266, "uuid": "e453eeb2-bb06-4615-a3d7-7ce17cefaa59", "value": "45k.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e92aa5a-9fb8-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1646837555, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646837555, "uuid": "2a48ca10-d156-4bb6-bd02-c4b84886ca32", "comment": "Malware payload (Formbook)", "value": "944ff4428b4e2e6b45ecdaa440ef2d83", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646837555, "uuid": "4499caf9-5b9b-4449-8c00-c0af9ec808ba", "comment": "Malware payload (Formbook)", "value": "546a20fb078876e20edd14821f7c99e66e9ec38a3e35e14731774956287eae73", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646837555, "uuid": "82da0c03-b1ee-475a-ba6d-b398196d20b2", "comment": "Malware payload (Formbook)", "value": "6a07c5a6dfa4e1925c87fff996b6387ecf705599", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646837555, "uuid": "25c6c503-f84f-4ca5-bf3a-54b418452e5d", "comment": "Malware payload (Formbook)", "value": "0aa552cfbc9e4bc9bda6004f5de949fee1a64f406b7893f1854e3d9cf73b49968cd9451ef4054dd0795ccc76440b30f8", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646837555, "uuid": "5d7e9e8d-29eb-41ca-aa07-ddde484ad94b", "value": "T1C51412623AC261E9F9B74EB49BB69C190CFADF4A882C041C53DA3009E57DDB42875F58", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646837555, "uuid": "1e0a7e66-6399-47cb-a06d-c92e9498805e", "value": "3072:Y1OMpMRPdlPp04N/PywYsW+sKb7JXCOJ87Gxii6CG3a8EJ3jYXKG3a4Yl/lb:2pKVddZN/aCNvhcUA1K8EpYXKU4b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646837555, "uuid": "852bfffb-4f64-441d-9e31-bca1f310d52b", "value": 191272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646837555, "uuid": "7042c1b2-ce9c-4479-aca5-a9bc2b494fc5", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646837555, "uuid": "d7aee1ac-fd05-4958-8b43-70b0b9cb798c", "value": "SHIPPING DOCUMENTS.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c3ee4ba-9fd0-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1646847752, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646847752, "uuid": "ca0cf1c8-0dd4-4260-a9c5-15bf597c2013", "comment": "Malware payload (Formbook)", "value": "185536d465ef184a96583ffbae2d1ad4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646847752, "uuid": "1fe4aa00-7089-4e3b-9b50-92b307525493", "comment": "Malware payload (Formbook)", "value": "5545c50649bcc9ad5199a2c7639b0b182ea5221a35c22e219378b136c4a5d9da", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646847752, "uuid": "390260db-dfc8-468c-95a5-c64f2921fa03", "comment": "Malware payload (Formbook)", "value": "367ff9375164905a8058edf4e9953e8398af6e08", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646847752, "uuid": "da1b29fe-53dc-4150-8e7a-c4b342aeaf35", "comment": "Malware payload (Formbook)", "value": "dd42f5d67c9efc61820f480e8dca99d3d5aab1cdf917307e06bf01e40126459423bfe6b851c46576680f9f64d3e03107", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646847752, "uuid": "0eea9794-4cf9-4a48-b787-91b6530eec22", "value": "T1D6457B943B56E0CDE4629EBE59D4ECF09BD1FC261E0E71A620973F1B6A7AC43C910172", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646847752, "uuid": "68c54b40-4378-4125-a5a1-b2638e9e4620", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646847752, "uuid": "dd7cc8dc-faf4-4cb1-aa1e-9748593af07e", "value": "24576:7sxq/QZaXJCLhcjLIhbXEvZmhP6n3HsK6A6j:PJ/Hq7EBmhin3Mm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646847752, "uuid": "a312aafa-0825-4fb1-8dcc-94ff44707944", "value": 1203200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646847752, "uuid": "bd4b25aa-deb7-488b-b529-46f304d9d205", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646847752, "uuid": "df4e48fa-a376-4c5e-bcef-a161f8968993", "value": "EventIgnoreAttrib.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba346b82-9fc1-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646841494, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646841494, "uuid": "de205333-9b81-4203-a6b4-4badd5c1404d", "comment": "Malware payload (Heodo)", "value": "42d8c90a596df1130eefa7b340883716", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646841494, "uuid": "7e3b0072-e9b8-4835-8650-fe34bee8ffe8", "comment": "Malware payload (Heodo)", "value": "55946bc50978975ea4a7c009d3eca8a4a2fd0ea11c308d6d889cdbadda5f1cc8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646841494, "uuid": "ea1f3cef-cce3-4852-b9cc-26320d246494", "comment": "Malware payload (Heodo)", "value": "999bdb78e9f27a288fc147493b55773c8b20be46", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646841494, "uuid": "ffc6a3c5-d2bc-4561-a2e8-81bdde025fd1", "comment": "Malware payload (Heodo)", "value": "1dfbffa9118b3c9d6f6ba7c4a1eb80f31c5e020afac6466a2279c1367a1814f4b5e2a3e15f152bc0a309b0483150a769", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646841494, "uuid": "038cfd3b-7e6e-4f21-aa0b-7a94f881de4c", "value": "T1B1257C107E8A817EC71B85B30836676D6FFEAB204B6CA1CB478175ED2D316C29B36705", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646841494, "uuid": "dbea912a-dc9c-418e-9ab6-760ecbb5dc19", "value": "087c9809507dfca4c3283e6c7539e91c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646841494, "uuid": "511a5fa1-88ea-49d9-9fb8-d76fe26c9b85", "value": "12288:cR5SOyRHiA6m0OcElczt6JtcS1j2xKkr:cR5SOrKlczEtcK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646841494, "uuid": "e408628c-3b7a-48a5-8a32-fbd61c374db5", "value": 1040384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646841494, "uuid": "51506658-7083-4110-a578-e08902b21b85", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646841494, "uuid": "9a06a792-6f27-4f15-9c96-df77b54a6108", "value": "42d8c90a596df1130eefa7b340883716", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "980ab273-9fdb-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1646852603, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646852603, "uuid": "adfda001-4e5a-4256-8ed4-7458cb586d3f", "comment": "Malware payload (Loki)", "value": "eb32152d9e652e53120e9e8d17737187", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646852603, "uuid": "65ada723-af0d-4628-85ef-2e15e87c8233", "comment": "Malware payload (Loki)", "value": "564ba44d994ab5c2881b64ba2c9e5b444ffea62432853346e1086e4ef9f01a0b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646852603, "uuid": "ebfe6e30-9008-4c5c-9582-9505c4ada88d", "comment": "Malware payload (Loki)", "value": "c3ec12a47a37cd596c50e0bb3953b56f0e848da7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646852603, "uuid": "1047b69b-e963-45e7-821f-eedb85b3a2eb", "comment": "Malware payload (Loki)", "value": "6d7ce74ee55748760d3e1f0a73f653d6f48ccfc59ff92ad0edcbff8db6d8eab7906681b065bc0b6860d8e0dca5e22839", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646852603, "uuid": "447d0a5c-e174-4c63-a477-ce242a3b97a1", "value": "T18D74230C29C2CCBFC1A693344DA7A9B7F7F36A2647561EE21F107E917A8A44B444E7D0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646852603, "uuid": "bf26b254-58cb-4ca8-b189-86e26a66edf1", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646852603, "uuid": "e255f391-43ed-44fc-b136-f49f962c19ad", "value": "6144:rGiXRCK1WH7+LrU/ZCndz5CzolS8Pea4/Dj8Zo2ac3hLPMx3tcA8Ti5I8COu90n4:b8KAUrU/ZCnXeCyj8Zo+31sTCOuC4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646852603, "uuid": "f414c07e-8f73-4af6-be09-61625b6f41cd", "value": 341133, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646852603, "uuid": "761140b9-967b-41a6-9ee9-2b0683424ac5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646852603, "uuid": "879cc458-b943-4320-a96e-52656d97b574", "value": "vbc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd2571a8-9fac-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646832506, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646832506, "uuid": "c5f00fb6-1168-4e26-8379-30c40d112331", "comment": "Malware payload (Heodo)", "value": "26350d3ac5c939cba458e3029dcd4213", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646832506, "uuid": "7594994f-1089-40f4-8a2a-18426e7daa9b", "comment": "Malware payload (Heodo)", "value": "566d853cf9481f4698bfa70a44fa09d23fc43963af775da590e6be2085b69fbb", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646832506, "uuid": "8462ae22-89f2-4d45-b3fd-bf902ef956b2", "comment": "Malware payload (Heodo)", "value": "31dc67f5017a31f6fe6e7ffe213d585a61aa2e53", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646832506, "uuid": "5f3738eb-a523-4e85-90fe-c68e15d7583a", "comment": "Malware payload (Heodo)", "value": "5cfefc1d3a8049666a008abaa8f27b585b1781f441e6a2f9e25684e252070189fde35f9c27b5fcc10a819e6580fb70eb", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646832506, "uuid": "b9a6be2a-fa02-4948-96e7-721ac9be2254", "value": "T1BD23E03CA042FA1CE266797D920C48E6960D21617045A56F3A0C7F6D2B869E70B1F7EA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646832506, "uuid": "ad92aad0-74b5-4b38-b19e-818c9a685f8a", "value": "768:jO+CAEWvxRc3mlkKDNWBA7rTj+RYV8Q0RuVBR2jPrtysHRX0AOBAa:j7O2b8QkKDNck01u/R2rZyjtBl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646832506, "uuid": "5aba4ce8-2ab0-461d-b426-8c2ba376effe", "value": 49573, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646832506, "uuid": "1676b00f-cfce-4401-b99a-eb8e32a74617", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646832506, "uuid": "9db4b656-ba80-45d6-bca3-b652bfcbced0", "value": "Archivo_51428.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe083985-9fa3-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1646828723, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646828723, "uuid": "3795541e-ff9d-4ea0-a9dc-82255b73b805", "comment": "Malware payload (AgentTesla)", "value": "2849f545ad958fc25224458c857b6996", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646828723, "uuid": "d1dcdad3-ff8b-4021-9190-191ae83ed305", "comment": "Malware payload (AgentTesla)", "value": "56e32b272a3416e20253d152a08dc767624bc7c868bfa6371f09021786ee4c5f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646828723, "uuid": "4d033d80-ed07-4fd1-beaa-7c94428cdc60", "comment": "Malware payload (AgentTesla)", "value": "95b5561005bee5cb0326529e7db89f59f25fd649", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646828723, "uuid": "4b1094c5-d9d0-4de5-ad4d-0f894fa30005", "comment": "Malware payload (AgentTesla)", "value": "98eb79e59d212631405647447676bea23fbb3ebe3da224235f21ea67af25912bd1c439ca93774622142efc7fff147029", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646828723, "uuid": "1fb76931-4e1f-44f3-bc1b-961732e779b1", "value": "T1ECB2C6156298B32BD56F85313C729F4C3226BE317491AFDB24873C3AF87319145A972E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646828723, "uuid": "843e9933-309c-4c74-9433-de3820c109e3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646828723, "uuid": "abc14e78-507b-4a96-be67-83eb04019b4e", "value": "192:GOyDxi2HuyQPT0hKxbdqQz/GrO2HLYhh/hhhhhhhehhhhhhhhhhhhhJhhhhhhhhB:qxiJP04xbdqQzkLS6S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646828723, "uuid": "96184fe2-36ae-4625-ae33-188ed6e2b06d", "value": 25088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646828723, "uuid": "fd9c2071-bcee-486b-bb72-54b09bebaa8d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646828723, "uuid": "023c87b6-1181-4cf2-bd68-836fb0a90fbe", "value": "1086005031007.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1574d3d1-9f89-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646817166, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646817166, "uuid": "87c50711-28ed-4382-af56-6c7627000ab1", "comment": "Malware payload", "value": "0466d1913a91b1c4c01c5cdf51a332cf", "object_relation": "md5", "Tag": [ { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646817166, "uuid": "1f863e8e-3c7c-410c-91c3-e1775cb9f0d5", "comment": "Malware payload", "value": "57cca8da3b7ce0b7445889442819031b64d2ffad04ff38f48983dc7a157bcd23", "object_relation": "sha256", "Tag": [ { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646817166, "uuid": "9563bb8e-1a72-406d-a364-3238884a59cd", "comment": "Malware payload", "value": "c70c632cc29860732cde84f741033ee209e41443", "object_relation": "sha1", "Tag": [ { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646817166, "uuid": "6b7fe118-05c8-4680-8a56-64e01a30638c", "comment": "Malware payload", "value": "05b2695d393ae03bbb2f578835ec6833d82c89effc49b7da7226da170ba3abae2fa2cb351c81ec6d9291b980c40c6b28", "object_relation": "sha3-384", "Tag": [ { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646817166, "uuid": "ab0e74d5-198b-409f-86b8-545cafaa2b80", "value": "T1B792F23AF68B8E9CCB0BD2D4150A3F861568F91C93D998D2A7FCF7746A4595F8322430", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646817166, "uuid": "6b0c80ed-0c7b-40fe-9d37-aad3244d2760", "value": "384:nxvJrxFmjGE9iWcBeUplr7gemlHIi2ZaKjJ0M:nxZxFmjn9vVUXrMHOZaKjJ0M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646817166, "uuid": "d89e85d7-bdc8-4f11-8135-1e08b810b398", "value": 20135, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646817166, "uuid": "1ac08588-3846-4c68-968b-ba5aa46a28c4", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646817166, "uuid": "21d21fd7-5d66-4496-b2c6-dcd89d9cdcf5", "value": "invc_00044.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9226a008-9fb8-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646837561, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646837561, "uuid": "14098d5e-4c1e-42e9-a97c-caaab73ffe3d", "comment": "Malware payload", "value": "206e9fa18d418e11a0416c30c44d14bd", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646837561, "uuid": "692d5bef-194a-45a0-8167-4d5937ec6674", "comment": "Malware payload", "value": "57d69cce58dffeffa3afef2cd792bb12e1ae6c05245d4c2b18bf05268ab77b8d", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646837561, "uuid": "5eafb14c-c827-4fed-8f4d-74cca73c99c3", "comment": "Malware payload", "value": "0251821b514b86f0b1e80ca262797ba1583e4fc5", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646837561, "uuid": "d22d2135-0eb3-437b-9a71-d206c69fc6c5", "comment": "Malware payload", "value": "498b282aa5508da43410dd76d627e98fa2901ff00accdadcf2a03900b50a3fc8e4ce185a656ffb35c838c69a3c28a24f", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646837561, "uuid": "3c8a9249-748a-498d-94d0-34090dbf55da", "value": "T14A84CE3CB2CCAF70C3EC1A3F9E75A411673D95851662E39F464794F90EE1B12A980A3D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646837561, "uuid": "c346977f-f9cc-49b0-9cae-7f18b37a373e", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646837561, "uuid": "5aaff17d-4e45-44a5-85fd-afd3dc868b91", "value": "12288:wieUwZTYXxmWFmwZ9DbQtGBz0Yklj0l9k6:1wZMXxowTbYez0wt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646837561, "uuid": "d09bc887-5fc7-4b3c-9f05-ee339ddc50c1", "value": 394752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646837561, "uuid": "2f37d671-6188-4f67-be18-05c76fc8d9e9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646837561, "uuid": "0a945cc7-81b4-4581-9a9f-f5bad3baaf70", "value": "Widvtjnbg1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a674e1a1-9f8c-11ec-9275-42010a9c0029", "comment": "Malware payload (Gozi)", "timestamp": 1646818697, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646818697, "uuid": "e731dcf0-03d4-4342-8dea-8688522d8c11", "comment": "Malware payload (Gozi)", "value": "87218fc5c2d6e41acd9c8e9d577a088f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "mise", "colour": "#B2AF41", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646818697, "uuid": "7adfda0a-6bf1-4447-9e5b-99e1b6d66692", "comment": "Malware payload (Gozi)", "value": "57d9f65f62b63e02b194c97d66d478f70a75df94abc134d45e02539cbb33d961", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "mise", "colour": "#B2AF41", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646818697, "uuid": "9876360d-7f0c-43fe-bede-d657477cc644", "comment": "Malware payload (Gozi)", "value": "e468c0578e3c139eb8e1ecdc61dece48ef3f182e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "mise", "colour": "#B2AF41", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646818697, "uuid": "cf33ff03-b133-4508-8218-1fcd1f9b903d", "comment": "Malware payload (Gozi)", "value": "5ef0713675810f77f834253d654881a8809fdd3c701e847bad1995b5e7bf8ce65ba9694b9b44d49606ee5de4b0147b67", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "mise", "colour": "#B2AF41", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646818697, "uuid": "64cf2bfd-4a64-4ba5-87d4-e89620bbbf0a", "value": "T1E054BED23693C43AC052B53D9C26DAB19A3AB871DA70C80777741B2E2E317C39A76716", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646818697, "uuid": "c844f57c-1bb2-471b-be2f-125d526a9e42", "value": "30b61c273b1d343ed1b1e7a06292b7df", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646818697, "uuid": "84f7e3d1-a2e4-40cf-ad0b-74595467fa0b", "value": "3072:xddeO3kqiVLcoo1zqA+OIbG508VggjcGkNIVqIZeDu2lQ:hl3kLVLcoolqAqnI7ITsqSeSe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646818697, "uuid": "a1526e4e-0d32-40be-b458-6738fb85e013", "value": 282112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646818697, "uuid": "2aeae786-246e-403a-bb4a-54ffc109f68b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646818697, "uuid": "27087195-ece9-41e8-ab73-90bb6ad9bb6f", "value": "book", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb696a2e-9ff2-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646862649, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646862649, "uuid": "bb30a648-da23-4c6e-93a1-4a9a5c86f5bd", "comment": "Malware payload", "value": "ba4380237e7a0f220deaaada1fddff73", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646862649, "uuid": "149449f4-8fe0-4c29-8e29-549db3aa6b2a", "comment": "Malware payload", "value": "57df82d0e4547407bdca25692313c2a95b07438991c4cfd44a85d85e5976a965", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646862649, "uuid": "9c52081a-1e44-4b04-89ad-53f6dfe7d5b1", "comment": "Malware payload", "value": "394b852855574cffa26a66bec083792a21f87f79", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646862649, "uuid": "5cc6c7e5-1a94-46dc-8ae7-185267c4eaae", "comment": "Malware payload", "value": "2aa863a9e371c3a2f29dd21c4a02a431f7a6056a77f14f3b8f0fd16ef14bd85df53f45ce340956169b9abc386753d993", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646862649, "uuid": "1bca5e7c-a9cd-4a6e-b0ad-bf6c0b95af1e", "value": "T1C6738D0387092011F6829875B4EDEB6EF9FB74F1575890BB6441C7DA49A0FD27FA0E0A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646862649, "uuid": "5063e986-a865-4da3-aa24-50a6348d2b01", "value": "1536:X4W3Dr5u1s1Xrhja8ayrwmN3jda05uDhlqt1bp/35:z3DrMCzzzda04qt1l/35", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646862649, "uuid": "3bdb4f20-d746-456d-a7df-9d723f00511a", "value": 76416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646862649, "uuid": "0aa20192-f9ce-4db8-88ff-c688b3c6564b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646862649, "uuid": "30c980f2-305f-4048-a53d-b5748b525c9f", "value": "SecuriteInfo.com.BackDoor.Siggen2.3475.2384.32639", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1acddd5f-9fd4-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1646849387, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646849387, "uuid": "6d144222-57ec-4c99-953d-a1c0c5c88348", "comment": "Malware payload (Mirai)", "value": "2846598a32e577c0dc22f92ad184a33e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646849387, "uuid": "fedf6c10-ecf2-46d8-a2b4-5b2befc1b182", "comment": "Malware payload (Mirai)", "value": "5819c9052124c4f271219740cf8bb72696f1cb7abecb4eca473eef56e1472a8a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646849387, "uuid": "049666e1-286f-4928-b7f0-96a97b1de864", "comment": "Malware payload (Mirai)", "value": "cf47d849d95bcda52b6689f65bdd748c462a489d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646849387, "uuid": "0ce90b51-b281-4b29-bfd0-2d70fe3df8e8", "comment": "Malware payload (Mirai)", "value": "1f264fcadc6d4f388bba12453ef74b0acbac4fa308c650b22b08fbfd505a29b16ab562c457191875a5cad6521c437c12", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646849387, "uuid": "4039979f-1bdf-4b44-aefa-e70e3715398d", "value": "T12773940ABF610FF7E8AFDC3789E91B45248D641A21993B797D34D818B24B24F49E3874", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646849387, "uuid": "a02a5ba2-28e9-421c-998d-e6c63000630c", "value": "1536:QGFfut1avzBpR5Ygxmk+yVZsTefCqNuRHx:fFfut1aLBugxm18u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646849387, "uuid": "63069f57-14c4-4a4d-b3b1-0aaa49860748", "value": 79900, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646849387, "uuid": "6230eb88-b53a-45c1-8426-020d2ade2eb4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646849387, "uuid": "d027e7a7-094e-4185-8176-0327fd439f80", "value": "2846598a32e577c0dc22f92ad184a33e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46f3555d-9fb5-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646836146, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646836146, "uuid": "f8e15863-16a7-4d9d-b1a6-c10e7859d548", "comment": "Malware payload", "value": "a71b0deb1deb51d7cc3caaaf264d7e52", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646836146, "uuid": "f062ff78-f63d-4e81-96cb-ebdb2fcf9347", "comment": "Malware payload", "value": "591664b493c52db105985517a8608b441dc9030edabddbf00336903ed61f9ef7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646836146, "uuid": "4ba57b78-f917-40b0-a905-b8db0ea6da61", "comment": "Malware payload", "value": "27de16637a94e11430c8b821be7707b0b94bc97b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646836146, "uuid": "6ef56069-b45b-4e8f-81d7-e2cbc9642e08", "comment": "Malware payload", "value": "fb9f353685f2ef502e431e34aeaa07170c71728f48be92b0355837527226a3e6a038d7fcbb1305c01f67e6274e1b0e6f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646836146, "uuid": "54de78a0-8115-437c-862c-08e5e7a23b11", "value": "T16302B72667A4827BEABB1F3378A723401576F21AC826D76F5E48400E586337507F3F69", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646836146, "uuid": "96b51609-6173-4bcc-8b39-c0ec21cfd1f2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646836146, "uuid": "ae7365d1-30ee-4951-b306-d4c174f2bcf6", "value": "96:DV0oLVZbGBSM2JXMY0q1J+DG9U62zc7+FonFoU4tT0ucf0WJ3Op:jVJcY9JkG2lCQoyU4tyf0M3Op", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646836146, "uuid": "629d3b69-da3a-49ba-bfe5-74329da3f349", "value": 8692, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646836146, "uuid": "1bb44dfa-fa0b-42cd-b95b-33f6192e2e7d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646836146, "uuid": "1038847f-710a-443f-97e7-de8df9fed5ba", "value": "a71b0deb1deb51d7cc3caaaf264d7e52.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7fa7c5cd-9fe6-11ec-9275-42010a9c0029", "comment": "Malware payload (SystemBC)", "timestamp": 1646857287, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646857287, "uuid": "45906820-63e0-4ab5-8d0e-013b3ade3927", "comment": "Malware payload (SystemBC)", "value": "686b40dcb167653cb7a8463928c26af1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646857287, "uuid": "305d5bbd-4ea5-45c2-bfb9-76e50e53d3ec", "comment": "Malware payload (SystemBC)", "value": "595e1545c53d27fb1315e70b241e66f44b28a49be59a717ca4936d167e121470", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646857287, "uuid": "4009493e-b72e-498a-9407-e79b6b55ef71", "comment": "Malware payload (SystemBC)", "value": "d6146b6fdf516223735e4e881fa797432dff3923", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646857287, "uuid": "a5675eee-6251-4c43-9760-6d3c2eeed859", "comment": "Malware payload (SystemBC)", "value": "47367493d8de6eb510a972f1a22c6c519edb0bcadd6b169acf2e5932393e8975d88c18666dc0617dd850959005c8b3da", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646857287, "uuid": "9949dd18-933d-44d0-a343-87f8f8c0a0c0", "value": "T134A6233BB368713EC4AB4B3249B39250A87B7765A41B8C1E47F4090DCF6A5711F3BA16", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646857287, "uuid": "47328a63-5d15-4d00-abf4-a9a205b7cd9a", "value": "5a594319a0d69dbc452e748bcf05892e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646857287, "uuid": "9fde07dd-11ab-4234-952a-8f293b429ec5", "value": "196608:/ylL6Qqq9pc9HG8e+AaO+aIfrFKLZB1ZkezGMr4Del7:/yMQ7Tc9m6FauFKLNZkezGMCeZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646857287, "uuid": "f1ef6e7e-1335-420d-ba77-b83622b1cfe3", "value": 9923049, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646857287, "uuid": "d9796e0c-a397-4036-9fdd-4c17a77e1e6b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646857287, "uuid": "1b9a04e9-8509-4470-bbe7-d2dafc2222df", "value": "686b40dcb167653cb7a8463928c26af1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61a271fb-9fbf-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646840486, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646840486, "uuid": "af585eb1-a4c7-4122-86ae-2df12d058a49", "comment": "Malware payload (Heodo)", "value": "c64565ab1c4d8eb717c62162d9ab3847", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646840486, "uuid": "8dd3a6f4-fe9b-4d5e-a034-4dc9039791a0", "comment": "Malware payload (Heodo)", "value": "5a36568cfc71aa69704412fa2cb42c6aa16734d3cc575e3a3597e27b62fa2d89", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646840486, "uuid": "14197e5c-b1d6-4724-8c36-e6fa3f961e29", "comment": "Malware payload (Heodo)", "value": "8a4b3c72654ec9bfb284f61266f5ed5ac7604064", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646840486, "uuid": "66ef636f-b6ca-44e7-ad87-47445f8dccb3", "comment": "Malware payload (Heodo)", "value": "4005c4a275d8f2455d85d18d9adf666a324bfa10798ea1b5067416058b991fdde62d37c3cd7490b904b62375ff3f496c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646840486, "uuid": "d77174d3-26ea-4599-9235-368cfb1cb969", "value": "T181257C107E8A817EC71B85B30836676D6FFEAB204B6CA1CB478175ED2D316C29B36705", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646840486, "uuid": "74a0a269-5e58-4220-b666-9cc5fa0b9ba1", "value": "087c9809507dfca4c3283e6c7539e91c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646840486, "uuid": "8a9867fa-ed5d-41df-8682-2ca90f95dceb", "value": "12288:cR5SOyRHiA6m0OcElFzt6JtcS1j2xKkr:cR5SOrKlFzEtcK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646840486, "uuid": "55575276-0414-42f1-8f08-c9ec8131439d", "value": 1040384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646840486, "uuid": "417e973e-82fc-42d6-833b-bca763df0de6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646840486, "uuid": "5820f05c-c831-41f0-92f1-8c8361a67209", "value": "c64565ab1c4d8eb717c62162d9ab3847", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e7b9578-9fbf-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1646840454, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646840454, "uuid": "13c228ec-9b20-46b2-9cf9-646212cde0e8", "comment": "Malware payload (Mirai)", "value": "07939685f1bf2a5f45b7494864545208", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646840454, "uuid": "bbfbe877-0376-4948-87e0-26942a6d6ae6", "comment": "Malware payload (Mirai)", "value": "5aedd7be5fdb7302dcd945b936fa8b789ff8dd05252844ab266b9b4bcce92e09", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646840454, "uuid": "6c1a130b-6aa7-4532-9a61-684c62374530", "comment": "Malware payload (Mirai)", "value": "cf4d301a0da69a86df89df7cc8ad2100141f04ca", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646840454, "uuid": "aeee1227-bbee-44af-9bb3-eb0069714ca9", "comment": "Malware payload (Mirai)", "value": "b80e6cb0b8c71c658565649c786f69411d02eac556356effb491a1a405a114d6996d41ba1038391dcedfeab37d5d5bf7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646840454, "uuid": "e5fcb436-6d70-4b25-bc77-13a9827248f5", "value": "T16703F161EA8952E2DDD15F3AF829890E56D9B3E085FFFCE06734C0502B135E1F6A9142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646840454, "uuid": "12a2a61c-b977-4a60-9d36-c625cdd3818a", "value": "768:VNSxH2GLZwJdoT+fZXBBXOXQB8VQ0GAo4G7dz+3UWAO:A2GSoTUBXOXDq01G7JE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646840454, "uuid": "e75c2fd0-e90a-4edd-90af-aeb148776bf2", "value": 37744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646840454, "uuid": "00664dc4-aa70-416e-ac42-a8d2814ec985", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646840454, "uuid": "6a40335c-2d0b-4c74-a9b1-64f26861caf6", "value": "07939685f1bf2a5f45b7494864545208", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1f59c24-9fb5-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1646836380, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646836380, "uuid": "3f324df9-131a-4544-9243-5eb87d18dea4", "comment": "Malware payload (AgentTesla)", "value": "54392823412160ad787eaa1c8513a1f5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646836380, "uuid": "3c7b3e40-1f52-45d7-894b-cb97135c876a", "comment": "Malware payload (AgentTesla)", "value": "5b15b1dcfd70e561edc74cf47f03237289287ff9d730ad448ace7d00981931db", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646836380, "uuid": "62852b4c-3444-4f9e-b2ed-5a38b2861eb8", "comment": "Malware payload (AgentTesla)", "value": "8922022fb3c89bfdedaea9864b68cfb9363e4e9e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646836380, "uuid": "0a9fd685-756a-4d33-a71f-be35bef5f7e5", "comment": "Malware payload (AgentTesla)", "value": "89a7735c9783b5f22fd4f6ffc44a5c19e5c735cb9152b524e5c770aed143ca853cb144b5dc0997bff882ef55a6b0bfd2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646836380, "uuid": "78caa20a-1aa7-48d2-9216-0831dbe4d8c8", "value": "T18EE423A02D404AA58FB23F7AB34D9F68BD70A48B5C5762F5E0187354587323AEE1F44B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646836380, "uuid": "ee2fc83b-3d25-47e9-820a-2c3048e8fec1", "value": "12288:eCV/92I5mk7Snf9b6zeCXvSreZpkXdDY0h8Ig5hCIfe7lSNUO:3V/9vD7Snf9bcFseZKXdDY0h8Ig5hCaT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646836380, "uuid": "c7de4173-07a8-4184-b4ce-efc39c220963", "value": 659844, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646836380, "uuid": "27867284-775b-4de7-b68c-42ecaf37dabe", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646836380, "uuid": "0e837fef-4ebb-4b78-8f93-c476291f840b", "value": "SOA.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65778c68-9fbb-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1646838775, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646838775, "uuid": "8a88a08b-194a-405a-928d-e1326fcf31ce", "comment": "Malware payload (Formbook)", "value": "f206914b33d4440804cfd64e1ec38d56", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646838775, "uuid": "2f7c87c6-eeb9-48e7-b241-591734eac469", "comment": "Malware payload (Formbook)", "value": "5b8f4d48c5ed6fad8b945600c34a6e0ca41d0a5b41ed8e52f58f1aa2eed82dd7", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646838775, "uuid": "f5f377b9-804c-4792-96cd-093c63e4cc77", "comment": "Malware payload (Formbook)", "value": "251140f55669f58fb40b15d7cb0c49a0b8dd6c75", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646838775, "uuid": "0b5037c5-12a0-4803-bd60-d469fb951b6c", "comment": "Malware payload (Formbook)", "value": "6e8f1ad20f7c214192161a2110bbcfe48a11285d0e17b62ba60a3704fd927d147dd5fde5b687fe9ad0c7f6e5727d0385", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646838775, "uuid": "2dc77365-7013-4141-b750-0d83fc615a9b", "value": "T18635BEE229EF845EF3336A742FD4F8CE9866EE63160A71CB10552F368432A41DD61736", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646838775, "uuid": "60835897-e2bc-4a14-a679-92be41c1aeaf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646838775, "uuid": "0fc443c6-2be9-4eb9-a853-19debce20ef9", "value": "24576:HD5kv/t3ic2K8szns+6xBLoYl45gcBLlkYPyzYTUb:HD5kvSDszcBLTKdLl2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646838775, "uuid": "d0fc9bf9-c031-4540-8033-4e059c894f2d", "value": 1146880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646838775, "uuid": "ee9efaa2-acd5-4443-813e-26aea107fa84", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646838775, "uuid": "a19dfdd8-aea8-465a-9efa-fb97cafd7bb2", "value": "DHL DELIVERY DOCUMENTS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8f38ee0-9ff1-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646862215, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646862215, "uuid": "062ac1fa-2f1c-4753-9d77-ed43549a4f9f", "comment": "Malware payload", "value": "32b3fad502b711ef5f5835ef2a1aad21", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646862215, "uuid": "965cf207-5c23-47b1-bd46-e51863f9175a", "comment": "Malware payload", "value": "5ba182a3507c2a34f28a7b91992a4503510886688b1eba295c8fd6352115d8a8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646862215, "uuid": "f4db3f4e-82ce-4306-8a57-36aefaf5cf56", "comment": "Malware payload", "value": "5eef412213c676e85a5a540200df3d4a5afdc234", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646862215, "uuid": "3d94dbbd-e2bf-4f83-a06b-254359d785eb", "comment": "Malware payload", "value": "3507964d2f7a18c6d81066af22e6daf7e667e6f798aee12b4c98459410ca1f8fee264bf4930b8aba146d25f742843c4a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646862215, "uuid": "122aea8f-a21f-4d4c-9b79-9c8ee5c9026f", "value": "T1AB257C107E8A817EC71B85B30836676D6FFEAB204B6CA1CB478175ED2D316C29B36705", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646862215, "uuid": "77d8064d-b298-48af-84b0-da12e8eb53b2", "value": "087c9809507dfca4c3283e6c7539e91c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646862215, "uuid": "cdb510fc-5d5b-4e61-aa83-543efc8912b0", "value": "12288:cR5SOyRHiA6m0OcEluzt6JtcS1j2xKkr:cR5SOrKluzEtcK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646862215, "uuid": "77b4b75c-69f6-43b3-b3ed-62bb2114a008", "value": 1040384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646862215, "uuid": "17aabc26-7ae8-4adf-a5d8-f9d01543e039", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646862215, "uuid": "ce993867-17a6-4473-97fb-1ece02ae5a83", "value": "32b3fad502b711ef5f5835ef2a1aad21", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d640cfb-9f81-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1646813743, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646813743, "uuid": "2a77f57a-c6cf-4f60-b5dd-215e33de60cb", "comment": "Malware payload (AgentTesla)", "value": "6e63456c1c8ace1538c86515b6d88307", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646813743, "uuid": "5190603c-83df-4fb2-90ad-f55ad994cdee", "comment": "Malware payload (AgentTesla)", "value": "5bba87174e702407de942bcfb620ee8573e0febef35da26d7dbeba447e47a6d4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646813743, "uuid": "9ee5df44-38f8-4272-827d-3d5d6e74832f", "comment": "Malware payload (AgentTesla)", "value": "ec6195c9bcf8b1bf24a5931f0c6bcfbd6fdc246b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646813743, "uuid": "6c3bb585-8118-457b-be73-daba50428811", "comment": "Malware payload (AgentTesla)", "value": "0abcc2cbad05e9f1f810b315ec8a307fcddb3e9bbac8f3a225e7d5f1f96e875717e9dd70e2f95b7e71a1dd74e5c6f187", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646813743, "uuid": "2c3d13f4-2338-4692-b2cf-22a233f98995", "value": "T19584235181793B2BFD8F45FE92BD8C7B288AD1F2722E941412DB37D91A0BD9481DB122", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646813743, "uuid": "f576509e-6cce-4510-8f50-eb30eab1c65c", "value": "6144:oxEw5QFU8JOuLnaeHxWpOJ3LUFNgTbrBeOKKP79IuRUHxZvn5t2G6Mgv7gbBkn9C:ouw5N8Zx6HgvrBsEIiURF5wLMgABEGN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646813743, "uuid": "b47d2b11-c7b7-4b3b-9f37-e945349eb0f2", "value": 396642, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646813743, "uuid": "7c0322e2-d700-44fe-966a-f99fab1cd71c", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646813743, "uuid": "73533bfc-5e4e-491b-bd28-ab1c1b5e8cf4", "value": "PO_Confirmation.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76b4cfac-9fb6-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646836656, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646836656, "uuid": "3a488913-cd00-4f66-b22d-2668f8211fdd", "comment": "Malware payload", "value": "9e876367063438341e2154d47c541ab0", "object_relation": "md5", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646836656, "uuid": "d0c537fb-46fa-4cac-a87a-d677c3d2a017", "comment": "Malware payload", "value": "5cc90c5ee745eb66103f0214bd7c5df20b6cfb28536ad6419c7d8d572fc17365", "object_relation": "sha256", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646836656, "uuid": "acdc65de-61cb-460e-8478-d0eeb7f3ade5", "comment": "Malware payload", "value": "e48572364ccee5797117d6cdd81e4202db332419", "object_relation": "sha1", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646836656, "uuid": "e4fcc972-bfa9-4b76-bd8f-1e9a63a9fdd5", "comment": "Malware payload", "value": "44ef917bae8adf2e588a3f4fc8599cd507847aa1ba11e35be3679608ab09a405f2821441e1215741955fb14f53f5e32e", "object_relation": "sha3-384", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646836656, "uuid": "fba45a97-8522-4adc-a464-addc0138ce7c", "value": "T11814CE653A84D466C64953304CE2C6E9B727FC86FEB782477255F32E6E732A0C80261F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646836656, "uuid": "ffb32895-5a70-422d-987b-f24c142cec2b", "value": "3072:qrxEtjPOtioVjDGUU1qfDlaGGx+cL2QnArtlri49Ui5AoUrhiWF+ZveKgSrAfHOc:MxEtjPOtioVjDGUU1qfDlavx+W2QnArg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646836656, "uuid": "f45d16f0-5d0c-4ac3-9751-638cb5662ae9", "value": 193024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646836656, "uuid": "ec6cdee1-3420-4beb-9322-ca5e7c332691", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646836656, "uuid": "10e50069-6370-44f1-8179-fc1c62975c9a", "value": "Pago.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6c00d6d-9fa2-11ec-9275-42010a9c0029", "comment": "Malware payload (Arechclient2)", "timestamp": 1646828174, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646828174, "uuid": "0eee1e06-de9f-478d-93ab-f322b05fc042", "comment": "Malware payload (Arechclient2)", "value": "f41f0efa2f092c10a00f72c24eb7285e", "object_relation": "md5", "Tag": [ { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646828174, "uuid": "6b6369f8-0707-44b0-a42f-b266a0f6608f", "comment": "Malware payload (Arechclient2)", "value": "5d3c5823083a457fff3bad4d6339992023bf6ab0e188b1b800a80b8e28ec1fd5", "object_relation": "sha256", "Tag": [ { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646828174, "uuid": "353a4b17-0f1c-47f1-a1ef-0ddeb81aca22", "comment": "Malware payload (Arechclient2)", "value": "0183ed07054b19f1fe3a2bacca83287e88d5a1f6", "object_relation": "sha1", "Tag": [ { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646828174, "uuid": "f5712c35-3bad-48ea-bcbe-5496bdfbdfb2", "comment": "Malware payload (Arechclient2)", "value": "90462cf613e769a73044dcce3afde0f27e9a10f70009468c51e473255c9dc25d2b2f43628146c87af1108d0baf0d339e", "object_relation": "sha3-384", "Tag": [ { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646828174, "uuid": "094bf4ed-735b-4238-b54e-a73a64095083", "value": "T1C0530FF08FF5B8A5E1152073B860B13C3BD75E4EDC655836E69BF14A38629C220E5E1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646828174, "uuid": "ddeb752e-c968-4fd5-9c08-420e27600f50", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646828174, "uuid": "92653e33-ee99-4146-a2f4-0f1d664e8814", "value": "384:uv7s6+xGPbc6TaSSI0D5b0zEjITTZIQZ1i/8JN77hhH:uzs63bNnSRp0zTTZ3viE3hV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646828174, "uuid": "07481c2d-ad6d-4458-8be9-3ef699904644", "value": 62520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646828174, "uuid": "07232b31-c767-4c13-9076-bf6bf6cd9382", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646828174, "uuid": "1f1dd2f9-8336-4d49-a3a4-ac4446e89c7a", "value": "ConsoleAppVV.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d74e35b-9fba-11ec-9275-42010a9c0029", "comment": "Malware payload (STRRAT)", "timestamp": 1646838385, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646838385, "uuid": "c37acf6b-e44f-4a05-af48-ef68899443e0", "comment": "Malware payload (STRRAT)", "value": "67c9045efd85f49665ec5749d50a35ae", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646838385, "uuid": "12732836-62fb-4930-af63-23cd2af461b6", "comment": "Malware payload (STRRAT)", "value": "5d9d1e11de97c20b26d92b86bc7b2090bc407951b1f13691a61125b276975b4f", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646838385, "uuid": "bb869ab2-22d6-419f-809a-fef7a14c4ee1", "comment": "Malware payload (STRRAT)", "value": "10ed3fb3dbbb0bdbeb7e547679ba5a5a6577cf7a", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646838385, "uuid": "1fb12d80-ad86-4f80-aad6-92ebe004cf03", "comment": "Malware payload (STRRAT)", "value": "847657742ca452489e102cff4938ee773aa5c6dcae9d36542a783a5f534ac7a2e614874c22461811f247bae45ba8b39a", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646838385, "uuid": "94d3a49f-4f58-4528-8eb9-07b29a842b11", "value": "T1770412A9060908D5F6B91BF836BAFF35C7B630D9EEE80A7B65C54C1102E458C35BC21E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646838385, "uuid": "e1f6ffe6-b71d-4d80-adae-c08241d7e5bf", "value": "3072:MjgxrzC0OfGj8QDkY4WTvNe5UJgmatah5zCxfnpsHEN:przC0QGvDkYXNe5ogmhv2xfpn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646838385, "uuid": "7cae22d8-7598-419b-8410-74d3413e9245", "value": 174199, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646838385, "uuid": "d07092f2-a2dc-4bf9-b82d-f8a2132d8f7a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646838385, "uuid": "eb8070d0-dc7c-4e2a-b268-35f4b57c8ad8", "value": "R.F.Q __ 2055211 __ 09-03-2022 __ 0001358 __ pdf.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff6c5885-9fcf-11ec-9275-42010a9c0029", "comment": "Malware payload (Quakbot)", "timestamp": 1646847623, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646847623, "uuid": "b3f17c3a-1942-4a1b-979d-b16067287b4a", "comment": "Malware payload (Quakbot)", "value": "c3883e64fd5f365807af808e004b2f87", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama164", "colour": "#6C68A0", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646847623, "uuid": "b03eac34-963d-4df2-8a56-a6d9421278cd", "comment": "Malware payload (Quakbot)", "value": "5daf4d0f896727963587153c42714e51439996b9a6ac190f1b749c0e25d22487", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama164", "colour": "#6C68A0", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646847623, "uuid": "d2d6528f-7ad2-4b1a-9317-34d4556cd6b9", "comment": "Malware payload (Quakbot)", "value": "56954d9ba08d0d366d8621201579346ca1c34638", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama164", "colour": "#6C68A0", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646847623, "uuid": "93f1ff06-31ad-49ab-872c-0ad6c48a1756", "comment": "Malware payload (Quakbot)", "value": "1f336cfe4f6ab29cff3268a5d67d71f5674c340b854af1f02a5d3d2b41c44622fdd4bb61f53e001c9ccb16a1bba52425", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama164", "colour": "#6C68A0", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646847623, "uuid": "b502ff3c-1941-421e-9b41-40972fa358ef", "value": "T117657E23F2C1887AD4761A3C9D1B739998BA79112D28F4C77AD44E8C1F37A433666393", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646847623, "uuid": "dc6b3c54-feba-4997-a93f-56813017cffc", "value": "cf78a88c4b0403a976a85038ec51a351", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646847623, "uuid": "25cefb57-542f-4350-b28a-01d0bb0cbdde", "value": "24576:LP2GXxd5hyXOZk/R8SoMbEYN54UUrW/tRJfJnOIU2SAHl4XoWSIgX4T:Lu8jI6kcYN9RniKKgX4T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646847623, "uuid": "9855e22a-6dc6-480d-8367-2df1b32e48ed", "value": 1502720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646847623, "uuid": "014aa0f4-d726-4e6e-be4d-18a43518802e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646847623, "uuid": "5d8f6ca7-c4e4-4f09-8eef-3efabea20ff6", "value": "7895117.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5bc9cfc3-9fa9-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1646831027, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646831027, "uuid": "ae3992a2-94ae-4b43-b8c9-3f43602b622b", "comment": "Malware payload (Loki)", "value": "eb95cf9ddf4e82c41ac7ee39480c4bab", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646831027, "uuid": "a2658911-66bd-4937-8d75-411ef278b378", "comment": "Malware payload (Loki)", "value": "5ee578d8eb6093a0d276d092a6e431f1a947c3aebf19887cdf1f10f0fdd58982", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646831027, "uuid": "aaa81192-31ff-4379-8766-188949681cbe", "comment": "Malware payload (Loki)", "value": "24a92a1b286cd73b85ed36f011b598cac16c738f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646831027, "uuid": "62a9bde1-2713-435f-beca-0290512d42c3", "comment": "Malware payload (Loki)", "value": "19204d74c16db8ec929e5c5365fe8dea81de758dca13ba7ac212f51f96b2d5af141be8676d1002596508be6148ddee9e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646831027, "uuid": "63264331-e647-4a32-a777-c71875f3c0c8", "value": "T1C4549D00AB90C035F5F712F8857A93BDA93E7EA05B3450CF52D52AEA56786E0EC3135B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646831027, "uuid": "428826ae-5f16-4237-b1d3-5f1d18e66a71", "value": "2eebe0dba96971c51a6bd6aeb0592251", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646831027, "uuid": "f864295f-7882-4719-bb4e-159c60b5d03c", "value": "6144:TOvN1Z+du2tpdq5G9fJVSF1BO+8KIhzlK0:CfZ+dzbdqw9aF1Y+dI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646831027, "uuid": "58295aa8-1246-4ed2-9e02-d341fb61166a", "value": 296960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646831027, "uuid": "687e49eb-bc63-49c5-895f-85e1d5b55cb8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646831027, "uuid": "9f243bea-d7a1-4813-a476-996722471365", "value": "eb95cf9ddf4e82c41ac7ee39480c4bab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dddabe14-9fc8-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1646844560, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646844560, "uuid": "79bf4af2-5d09-48a8-a30e-eb582f5d6a63", "comment": "Malware payload (AgentTesla)", "value": "dc877e9c889c207742da3f4d3a56bc82", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646844560, "uuid": "89f29efe-ebca-4011-b933-f493a857efab", "comment": "Malware payload (AgentTesla)", "value": "5ef3062dcba1af12b3380eeb6c6e0074b44619ed9b477547bb6b7f3bb9c8a16b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646844560, "uuid": "414ad749-5abb-4b0b-87e4-6aae37d7c62f", "comment": "Malware payload (AgentTesla)", "value": "742fb0bb460a816281b8273d20c5c4332af31397", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646844560, "uuid": "2cf2a270-c6e9-4a36-a5fd-2059ec6d5216", "comment": "Malware payload (AgentTesla)", "value": "86f5590ccacae23205e79b123335e6fa4481205c3c1884df22a4239962a2712969e0acc54c481f9476f9b324483211f0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646844560, "uuid": "8a90b759-62bf-4cd5-8951-9ac88a25545c", "value": "T17835ADE629EF501DF377ABB12FC8F8CE986AF973161A30DB10521B7684239809D61735", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646844560, "uuid": "743d58ff-bed4-42af-be8f-bddf8cce4098", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646844560, "uuid": "967e2ecb-3e43-425e-b6ad-3a8731283a0c", "value": "24576:+bD5kYtiIIPV1AYtxlY1YFGZ6O3L7XR/2Bp8MNrGjkmtPWtH0N:+bD5kYhIbtp8BxguoyAmtPWK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646844560, "uuid": "4aec8fcc-3366-4de6-9d73-b7671a62c0bc", "value": 1080832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646844560, "uuid": "5f2059f0-a1b0-4393-bf2e-43721a2e81c2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646844560, "uuid": "cc8fc822-d991-47b7-93d2-3bd5e63053b3", "value": "dc877e9c889c207742da3f4d3a56bc82", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf80567d-9fb4-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1646835946, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646835946, "uuid": "fedf387e-ad77-4830-b20c-725d2b4dd374", "comment": "Malware payload (AgentTesla)", "value": "e5da8269722ee7842a83a96b31862e06", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646835946, "uuid": "769f38dc-0e1a-443c-ad88-51743d4ee71d", "comment": "Malware payload (AgentTesla)", "value": "5fbb6b4c69b23f4cdc6964e6e7c403bcf4ebfbd5e1c210999ef7632d1e5fcf92", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646835946, "uuid": "fdcb6bd4-fbc2-4acb-bf11-07882d8f7e2c", "comment": "Malware payload (AgentTesla)", "value": "a6eefc49259be2b508177fd871cea509e8f65968", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646835946, "uuid": "d3043bf4-572b-4aeb-ad29-75a90415966e", "comment": "Malware payload (AgentTesla)", "value": "1deb78483b7f672daf644f1ca7a49405d50874ad865c80dbbcad25f8a61e646656750d1009ef3573c9b01c6fe41d0d7b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646835946, "uuid": "f03268b6-195c-48c5-87a0-f31cb5780a62", "value": "T1589423E9BAF2E506220EFA5ACFB81D46F992F32C60DD3D0D7C8466867994741B0197E0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646835946, "uuid": "aafb677b-2802-4a06-b2ad-b6fdca1b15b8", "value": "12288:MtTKrcb6VULNTf2O4zcoJmaKqV+GOVOYe:MKrQ62LNTlicwmVWUe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646835946, "uuid": "fa09f412-1e3e-4fa6-9562-ea36bf529119", "value": 410169, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646835946, "uuid": "86cc906d-f804-4e25-a13c-12db4c4e563d", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646835946, "uuid": "6d9e5d2c-8eaa-44c7-bbeb-26d97872845e", "value": "Proton SOA-EUR12646.05GBP220.6.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e507f24f-9f7c-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1646811930, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646811930, "uuid": "80dbfa08-169e-44aa-a304-249b611c9ff4", "comment": "Malware payload (AgentTesla)", "value": "6e513dcd35887a9eadc7a7904af02a3a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646811930, "uuid": "b434bf5c-e015-4218-a166-be42405e8ad7", "comment": "Malware payload (AgentTesla)", "value": "5fc97436911375f80b3c448de2f53a2980bdba21ae8f4bb961ab633ccac588bc", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646811930, "uuid": "e8c2f587-2dcb-42d8-aab1-a42adac81e11", "comment": "Malware payload (AgentTesla)", "value": "75ace54657705dcbeaa919e38338b9b5273deff1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646811930, "uuid": "4df219d4-0572-40e4-b92b-6cbcf7075789", "comment": "Malware payload (AgentTesla)", "value": "08128569fb3d2cdcf65aa2837ba4aad7e3c59b563f85142f7518bf66f8ed8bd052bec45e4d7d83d6f41bbe8532540cd5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646811930, "uuid": "b27ba95f-0fb4-4721-906f-c39f1b4836c2", "value": "T1EDF4D59C312031DEC96BE6759AA81D68FFA03C77831F511B902731AD9A3D987CF245B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646811930, "uuid": "52fffdba-21cc-4881-811d-eddf3f9bf935", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646811930, "uuid": "42fe2160-0794-4cca-8ea4-e129892415f6", "value": "12288:1rqcnaaZODg6YZcE9NJ9UHIbGH+rfGYBzYe7WLdPtSvQpxYp3qOAjcsXLmlYa0na:1ln9OjYMsGYCUF3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646811930, "uuid": "58e80826-dbd9-4846-87d7-56358b45bc77", "value": 766976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646811930, "uuid": "5816031b-87ee-41a8-a7f8-5e406fb9b4fa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646811930, "uuid": "d42fda60-f5b6-433a-b31b-76e9ba494947", "value": "New_P.O Samples.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "113cbdc6-9f8c-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1646818447, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646818447, "uuid": "5e5ee068-6576-45b1-b1a1-6086c7246343", "comment": "Malware payload (AgentTesla)", "value": "ae7508347b4a145efdf9e7bd3cd1b757", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646818447, "uuid": "6002baaa-70ed-4485-8157-251239b4eacb", "comment": "Malware payload (AgentTesla)", "value": "6076ad239201968364b29919c8ce945c0df0fce51416f5d9a73c06edfa1f54f2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646818447, "uuid": "dcfafd5f-a29f-476b-a19c-cd06fd448332", "comment": "Malware payload (AgentTesla)", "value": "c52621f5e4d0b96296c583428d3f1fff33304dd8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646818447, "uuid": "e2fb9d99-c1de-44f9-afde-4901b5b3548d", "comment": "Malware payload (AgentTesla)", "value": "e3b98223e86ed46ed17c0a61bbc51ffa139f2c2f9cd81aef73645b8c2a4de1443bcc929d4c02c6ec5ecf03bb0fe96882", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646818447, "uuid": "15c622b7-c0e7-429f-ae48-22347ae346c0", "value": "T1F5B423234BADD8B181D9F9F3AD3ACD80F0092F1656A1A47C5481C387D35A4F4AD6B2F6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646818447, "uuid": "e5efc0c1-83b1-4af1-a180-fb17f6b71f90", "value": "12288:lJ32sgaGzSKydg3Cvypyl+o8YTjrRqyFwb6jS:lV2hbyESrRqyFrjS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646818447, "uuid": "6c5badef-0b8a-456e-bce4-517bce684d83", "value": 528589, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646818447, "uuid": "4ba0fc43-2c2e-423f-a636-c2144f0346f0", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646818447, "uuid": "b624a7f9-4943-470a-b032-b94403fce66f", "value": "PAYMENT.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b05b9d73-9f86-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646816137, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646816137, "uuid": "5f40bbd9-f530-4557-82ac-d4a299470f20", "comment": "Malware payload", "value": "191e51cd0ca14edb8f06c32dcba242f0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RURansom", "colour": "#71CD12", "exportable": true, "hide_tag": false }, { "name": "Wiper", "colour": "#614E92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646816137, "uuid": "a1905c78-972a-40b8-9f64-6fbc20603d27", "comment": "Malware payload", "value": "610ec163e7b34abd5587616db8dac7e34b1aef68d0260510854d6b3912fb0008", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RURansom", "colour": "#71CD12", "exportable": true, "hide_tag": false }, { "name": "Wiper", "colour": "#614E92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646816137, "uuid": "160f7fcf-847c-4b64-84bd-135a5f8a7897", "comment": "Malware payload", "value": "fbeb9eb14a68943551b0bf95f20de207d2c761f6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RURansom", "colour": "#71CD12", "exportable": true, "hide_tag": false }, { "name": "Wiper", "colour": "#614E92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646816137, "uuid": "9dc506c7-f87b-41e2-8ca8-74f4c55f0a74", "comment": "Malware payload", "value": "8fcecab02bd06e735bd83fd40fb16ca3f747d8fe88bb3cd9ce8fe81793271f5464c19e157339b1298ea90a4c5e0e6c96", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RURansom", "colour": "#71CD12", "exportable": true, "hide_tag": false }, { "name": "Wiper", "colour": "#614E92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646816137, "uuid": "7a2bebd8-5f6e-4a05-93a2-d322ebbbdd7a", "value": "T1F2F10810B7D8E736EC6E467A9C2342000779F7D6ED4AE68E7DCD618B6C127081916B71", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646816137, "uuid": "59041bdc-c384-48fa-81ae-ff9858ca8d81", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646816137, "uuid": "b1f68c8d-9ac4-4bab-b8d3-0f223bc6f862", "value": "96:lRUUDiKPiwQG+8/UAZPaZWexiqvyWtTkiI2JxeSmPzNt:nDiKPQG+8/PZ2Yoki5JxejZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646816137, "uuid": "e697c7cb-98b7-44a7-a115-74d330112c11", "value": 7680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646816137, "uuid": "871f9718-0a15-45c2-b25b-e6d123bd7fd0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646816137, "uuid": "318d2760-f828-4271-93e4-7958afbde434", "value": "610ec163e7b34abd5587616db8dac7e34b1aef68d0260510854d6b3912fb0008", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be5413b0-9fb8-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1646837635, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646837635, "uuid": "daf09741-6bc6-4af8-ae94-b905c6209aa6", "comment": "Malware payload (Loki)", "value": "4282c2dc2e0dcdb6b13205efb52aaabb", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646837635, "uuid": "8afbbdb8-9452-405a-8c99-ee12c38f485b", "comment": "Malware payload (Loki)", "value": "6125021973006e4177422fb6c40f293008a38484ce6fbcfe39b1da02951f049e", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646837635, "uuid": "bd8bb183-cd32-43cd-875a-22e15584cedd", "comment": "Malware payload (Loki)", "value": "dc6392a9a0bd43ba220c08cf6c7c6fc30a1ab63c", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646837635, "uuid": "a4571ae3-4cef-4e9a-980e-ad54dccf0918", "comment": "Malware payload (Loki)", "value": "eddb7c690a1cb97bb935526c0038b60e885b0b3d791792097aec291a20b67448220ec70164b95c4ea81a2bb084301306", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646837635, "uuid": "fbafc646-d170-4373-82e2-e84d08bb06cf", "value": "T14A141218EEB5E34AD7DD65B012F09EA25E3BBD4949C12804A29A73C147BB350ECE117F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646837635, "uuid": "6b056878-ace3-443f-8d3b-964efae721cb", "value": "3072:ju9791mEU9ra1NaI8bF+5vntD+WZghRBJ6aY6UfY+8Ng5QwyBGJ4KTfpuSTdClAz:49wEU9rANaan9wQWwkgqvB1AUWEusk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646837635, "uuid": "c79e175c-fdd1-4683-a13d-913d8ed789d4", "value": 190760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646837635, "uuid": "6acbeda3-73c5-4f0b-9097-16d6be92eeba", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646837635, "uuid": "363a5c3f-7ed6-4bf1-a0b1-1cd01e104fb3", "value": "24.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66b9da23-9f70-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1646806565, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646806565, "uuid": "e527c6c1-7a6e-4c1e-91cb-b664b46a37cc", "comment": "Malware payload (AgentTesla)", "value": "36f09d204bcadc204a5623aeb369e208", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646806565, "uuid": "278b3dac-4054-4e12-9c2d-39adabe69ab4", "comment": "Malware payload (AgentTesla)", "value": "6161af5caf6338ddb7763a551e6129693f0c560eccbbe9d11bd0c713dbccb1d3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646806565, "uuid": "ed61eee7-5ca8-4cc0-b4b3-7e3a823bd5c6", "comment": "Malware payload (AgentTesla)", "value": "d3b8a90c5c21f79cdf9b3d0a44efca0875003564", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646806565, "uuid": "8853ae7d-0a87-4ce0-8d0f-449d9a5fe679", "comment": "Malware payload (AgentTesla)", "value": "1a7afa4c7cff53c59d99de950af28f0e7610a56dac5e3c8c63811950b4b4a5841d2ce55521397cf2d6a6088471451dc4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646806565, "uuid": "778b891e-421c-4ebd-ade3-0dc15aaaff8b", "value": "T1A5F4C69C312031DEC96BD6759AA81E68FFA03C77831F511B902731AD9A3C987DF245B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646806565, "uuid": "d0899008-16cb-449f-80b6-3b8357443ae1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646806565, "uuid": "cd3cb4f6-b60b-4eb0-8776-a74efd97cc56", "value": "12288:vzEcD0ycznCTimJOjNrRcHlClLZXlrVzb+s5hyZaKuejYFUw9ADadbbpEERff1fq:v7D0ycznC5JO5NlLZXTW/U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646806565, "uuid": "64ea1496-d9e0-485a-b091-7ff89763fe2c", "value": 751616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646806565, "uuid": "bb1ce1a2-7607-4481-abe5-2f10ce34977e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646806565, "uuid": "b2058cbd-b9be-4cde-8d93-fec556989577", "value": "SOA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b18b3292-9f6b-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646804543, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646804543, "uuid": "471554b1-5050-4431-b573-6972895e7836", "comment": "Malware payload", "value": "b086d797326a334d4819a70e6e80c171", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646804543, "uuid": "c8246742-7be6-4679-836f-8428caaa52bf", "comment": "Malware payload", "value": "6229f6de17bf83d824249a779b3f2a030cb476133ab8879c0853bab4fdf9c079", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646804543, "uuid": "eeadf568-8924-443d-b418-7a54cfb959d4", "comment": "Malware payload", "value": "3539fdc2d7a0d6088225db89853a8b6695e997ff", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646804543, "uuid": "d72f23d9-5798-4952-9680-e443f05be1a2", "comment": "Malware payload", "value": "c875b50f71e7465f9b7702af440e17ac10ddcbf6eadd0087d60620075629f3b1e63ea762b0ddb0672152524922fe490a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646804543, "uuid": "89ca770b-8eab-4103-8a11-d2fffd615c4d", "value": "T163458D50F592AE9EDD673130105FA339AB341D2A0113CFE78BBEAD71AE1B752B908705", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646804543, "uuid": "53bc8634-7a7a-423f-95fa-c3a542e3ebfb", "value": "9e63e57f4b28dd58c6310dd0f778e4d5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646804543, "uuid": "f9cba58d-4e50-460a-b155-123462446b22", "value": "24576:ar7IOCN48CIhDJeDrX64etXtnNMy0OvRqVbAdzcB24bMyR/:w8CwcnQMPOJlsoyR/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646804543, "uuid": "3f6696e1-00f6-41cd-b852-71a89a89e422", "value": 1175016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646804543, "uuid": "2ed0bf1f-3bc3-439f-b5b2-005e3a28e7ad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646804543, "uuid": "f2df4f62-a7e0-4140-849d-1209e13362ac", "value": "random_survivor.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e7cfb99-9fc4-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1646842548, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646842548, "uuid": "14a5230e-2abc-4272-a7d6-c8a4d282a884", "comment": "Malware payload (Mirai)", "value": "a6e88724f6a7bd826125ca2fa3b96bc7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646842548, "uuid": "6da40706-8cb2-45dc-8ef6-1ac73d38d2b0", "comment": "Malware payload (Mirai)", "value": "623ba55decb391a4b8f1ddd383e357ab6e67e43ed21d52f00b022ff2189eda42", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646842548, "uuid": "f5486827-8cf2-4693-8dc6-ee870d12a80f", "comment": "Malware payload (Mirai)", "value": "f4c93ad04aca4e6d0634b86aa3180e358820cd67", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646842548, "uuid": "e8afc418-820f-4869-acda-e6a94199358a", "comment": "Malware payload (Mirai)", "value": "fe2894b0b79f49ac23385e2d1ca6e6c9e5e23073f4e79092948d78a0a1a1e82f33f33e1f3517eb867b9b2694545cc087", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646842548, "uuid": "b7eb83c2-341b-49bf-abfd-5f44d06789fc", "value": "T138D2D116E7DE003FE7E07930D33AC98D09AA55E9E1B672315B11865D1EC98A0A9FC3CD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646842548, "uuid": "9624dfef-23e4-4d59-86c5-9749f45dffad", "value": "768:wv4SoulFJhrMOTz5oK9No6TkzN2YWDtHfyIZ3U5:MB9r55oko6A45pHfLG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646842548, "uuid": "65404a57-cf0c-4692-b2d8-3bf0a35745b5", "value": 28432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646842548, "uuid": "2f872ddc-4135-416b-8603-578df7c3e085", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646842548, "uuid": "d5a5aa51-b098-478b-9b9f-fcdd29737c5d", "value": "a6e88724f6a7bd826125ca2fa3b96bc7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "271d3ded-9f96-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646822779, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646822779, "uuid": "235a613b-46bf-46f2-b7d7-43b837584e57", "comment": "Malware payload", "value": "8660977f038a3a9a72031e302a03dac2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646822779, "uuid": "e1a1fa39-c567-47af-91d5-393c5bbcb9ad", "comment": "Malware payload", "value": "62a51134368ad7001f4ffb6e4e5fcd98b51821f73182a2e4fba40ff3d1b58144", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646822779, "uuid": "9b547d90-bfcc-4cfb-a2fe-5393cccf1a31", "comment": "Malware payload", "value": "6cb6bb35d2706089106b68439c8de137bd72cd53", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646822779, "uuid": "928379f7-5133-484c-9a42-b98a2ea5600d", "comment": "Malware payload", "value": "680faab835c80e0fdc04eed2a53157ae13efc748feb4863cffeda64212a8c1e516f01b36423be17a7043e2ad5093873b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646822779, "uuid": "2a6e0ebc-e1ef-4a28-8678-a61471473daf", "value": "T14004AF4162D3417FD8A1A670D8EC4A90D5EF3E223A75CFCB660D253EDC396A10376E26", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646822779, "uuid": "6f4fb478-3cce-46bf-850d-166c463cd99e", "value": "3a21a966298de7f58076dd90c76a8031", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646822779, "uuid": "83690e41-9913-42ec-aa4a-ffe3f06f2205", "value": "3072:9dXteGmg8DNNZzrbxKxrJ3mg0WqPexeSWS01x:rXteGc0xrJ3mg0Wgpx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646822779, "uuid": "95dd8971-1d9f-4da0-9b17-926732788d3f", "value": 178688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646822779, "uuid": "16185ddd-67c1-4703-8674-8215be67422d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646822779, "uuid": "8ce98668-7007-438c-a8ae-655a08da521b", "value": "SecuriteInfo.com.UDS.Trojan.Win32.Formbook.gen.25462.30320", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25ab88cb-9fbc-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646839097, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646839097, "uuid": "a7158fc5-b221-4a62-b61d-7fe1515d6aa2", "comment": "Malware payload", "value": "196509d1713397e7cbe0c7c9ed5bb783", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646839097, "uuid": "27bd351e-2742-44d8-b3a2-a822bd34d20f", "comment": "Malware payload", "value": "6399814e06253b852792dccb2e02cd468233cf5ada2ed39e5f7202e8d24f8901", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646839097, "uuid": "44d712d1-5878-46ab-baf1-e315d1a32aec", "comment": "Malware payload", "value": "da030d0057a11cde156f5b1387c646cd4ce03ecf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646839097, "uuid": "9db5387a-957b-4bb0-a998-b561dc27107b", "comment": "Malware payload", "value": "0b88021faf34327b868bd4a9e7718ba2157f96bb360f2949c7e4ecf46cf6eb38c4483fb19c16e1942acdb8b962071057", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646839097, "uuid": "897e4228-167b-4be1-bec6-3b6499d781ad", "value": "T125563377E237824DE0BE42B153551BA7B865F507063CD6260F4AFFAC7C37A908669382", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646839097, "uuid": "f7d75a63-c6e3-4f7f-b7f2-8c0b7f7332c6", "value": "d1de500e42d2702177623521d4e86120", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646839097, "uuid": "d3f00a46-0a68-4fec-9fd4-a78c137352cf", "value": "98304:asWe3YPq/i1vRMRSEzk6OkSrxwIDspP+2v1MbogKWYtgSNPZQL0nhqe6AMRombvM:/x3Iq/svCReZqkMP+iR/WZSlZbAPHo/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646839097, "uuid": "ba8c9b3b-fad5-423b-b04e-66b218642291", "value": 6387609, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646839097, "uuid": "1cc426c3-57df-463b-ba81-1bc24ca9e5d6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646839097, "uuid": "63a6ce26-f529-49ea-857a-ba1473e0695e", "value": "196509d1713397e7cbe0c7c9ed5bb783.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea0f7527-9fe2-11ec-9275-42010a9c0029", "comment": "Malware payload (Smoke Loader)", "timestamp": 1646855747, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646855747, "uuid": "f9855ce0-c468-4096-bc25-bde73ab627c0", "comment": "Malware payload (Smoke Loader)", "value": "d09da2c5d62f0bdafdcd0aecb22ca327", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646855747, "uuid": "a9f455c9-ac66-4bf0-a379-c1d29b11eb58", "comment": "Malware payload (Smoke Loader)", "value": "640e33013ce3399b038c711c9bd6b9cea8a8f50ca0e5e13a39f0972dec56bb49", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646855747, "uuid": "809d463b-e8c8-45a3-8a25-df3b6cf13e08", "comment": "Malware payload (Smoke Loader)", "value": "b40a53f218d187e937c492473b9dfc7f1e03ce15", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646855747, "uuid": "9207d41d-f390-4e0b-8bbb-6c2801b1e87f", "comment": "Malware payload (Smoke Loader)", "value": "1cae4fa7b041e81471d421414b4ae5e2d03d11768ee36610571cb899731e3191f4cd6944f9e676cb3bc2d5ab9147b840", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646855747, "uuid": "4c3d4898-66ee-41cc-a828-f3f284e367e9", "value": "T13C749D10BB90D035F5B712F899BA936DAA3E7AA19B7450CF52D51AFD06346E0EC3130B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646855747, "uuid": "b97b39ca-8375-49cd-9ba2-6b6ea65e4b5a", "value": "0ca9b05a489def699a29df5061ef8fa2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646855747, "uuid": "2e6fb7dd-5e50-41f5-b924-35f303cbc84e", "value": "6144:/PyvoovJrMW9pp1HpgsU/tL1R6b9HMawSQ:3NoRrMg/1HpgfL1gb9HnP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646855747, "uuid": "38747372-3cca-4ed2-a3ac-e7a0b45997a7", "value": 365568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646855747, "uuid": "7d1f85f5-ffcf-4273-a77a-499dc0bcf5fd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646855747, "uuid": "2a90bfc3-478e-4994-a2a1-572c8387a434", "value": "d09da2c5d62f0bdafdcd0aecb22ca327.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29c829eb-9fe5-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646856713, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646856713, "uuid": "7beafc04-7820-47cc-8488-c7baeebc5477", "comment": "Malware payload", "value": "34d404c6f84058b77b4ef49315d20e44", "object_relation": "md5", "Tag": [ { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "ta577", "colour": "#2FEF4D", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646856713, "uuid": "5fa2981c-b8eb-4150-bc13-7281088d594b", "comment": "Malware payload", "value": "64379cfe67902bae9fcfda0be7469c34879315cd033ac6b7da02465ebb97da42", "object_relation": "sha256", "Tag": [ { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "ta577", "colour": "#2FEF4D", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646856713, "uuid": "aeacaca8-bf5c-40d1-a276-5d42a3c0d316", "comment": "Malware payload", "value": "1f21f5205b921f2e10dc00552d978cd0a1a1c201", "object_relation": "sha1", "Tag": [ { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "ta577", "colour": "#2FEF4D", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646856713, "uuid": "ba790942-64ac-4714-ac1c-b9451b38fe7f", "comment": "Malware payload", "value": "d991a4d75663bceae6ce3e645dc3307eb0528db8d3c6d8fc942df5e5b57210ece27eefedea633f690c3b27783af5a7a7", "object_relation": "sha3-384", "Tag": [ { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "ta577", "colour": "#2FEF4D", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646856713, "uuid": "d714bef5-eb9e-4076-8cd1-33d06ff97834", "value": "T124242366D65FC58BA13CFC2EA6D94903A54FC3379CA3ABF3641D05F4007720CE29A686", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646856713, "uuid": "dc392498-a474-4b5f-a770-986aa41aad9a", "value": "6144:APgHIfn+7xjTCoTfhw26n+yflA9HywEaaZ7tj7:OuIf+BTC6fhw26+yEH9EVFtn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646856713, "uuid": "a072ab1a-c949-4074-8a63-556c4ddfe817", "value": 218942, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646856713, "uuid": "059832ae-3ac4-4968-8308-ab7e7ca65ef0", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646856713, "uuid": "19b8eaa8-dc41-4298-9a9f-90cd98913ae4", "value": "aodelro.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0031b639-9ff3-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646862657, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646862657, "uuid": "1ec599a3-b5e8-445a-a013-01c385314ac6", "comment": "Malware payload", "value": "c308652d2ee490eeb3d49fdbe52998aa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646862657, "uuid": "6f6e1ec4-5c30-4bbc-b72a-41bb36e8edaf", "comment": "Malware payload", "value": "64e1679d3c2d910366bcf309a51324b46e00d61225ec5f14ed43d70618cb061d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646862657, "uuid": "a820ab4f-d31e-4747-bf2d-81b37548bac3", "comment": "Malware payload", "value": "f1167b3a55a635536823b80ae986f1fbe7de6c65", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646862657, "uuid": "be84616a-6131-45ff-8980-20728a90ef5a", "comment": "Malware payload", "value": "c5049df17a8fcbeeae6005fbb8d798c13effbdd05c6857a955582a53376ed6e27edc329156b1fb9d9a4df5107ec4424a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646862657, "uuid": "77a63df9-1458-4151-9acc-1fa55b340391", "value": "T1AB263342B7DC2E1BC63F10350898FDA79D8623E9ED22B7CAD935A5A635D83E354440EC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646862657, "uuid": "b6a2a367-53fb-4a81-97d0-c9900fc318ea", "value": "fddc083fa31a17c938d0a17ec7cd3025", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646862657, "uuid": "db01f805-fc9e-4b11-9d34-65d688f5ef5b", "value": "98304:r/qUMBtZHErmUomlQz57sliSws0NMGoluuXSwAWT68Gg+a:r/qFPH5UomlQztEw15Oik6dgJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646862657, "uuid": "dea21ad3-0126-49a0-875d-caa5063f4653", "value": 4855448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646862657, "uuid": "a2e20a8f-b642-4baa-85b6-22f88d7ba3b4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646862657, "uuid": "f724e194-0f73-4ef5-a81e-b9f566be4584", "value": "SecuriteInfo.com.Trojan.GenericKD.39163681.27747.5123", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1040b5e-9fc1-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1646841478, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646841478, "uuid": "1ce7df18-1d3a-4242-b698-f5fc5fa75294", "comment": "Malware payload (Mirai)", "value": "0ff3ef4518907ea87b14aae0282cb423", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646841478, "uuid": "aab7baac-e92d-4e12-acd1-251162350c7a", "comment": "Malware payload (Mirai)", "value": "650b0b8c8e2e0b3dab492f66b1e9c56e825fff4985b3c4057669ca0e754c38ff", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646841478, "uuid": "4c4b719e-2e5b-4815-8ef9-cd797a2c1495", "comment": "Malware payload (Mirai)", "value": "5acd609690a838809b3935783a22c598fda6b53e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646841478, "uuid": "65ff986b-42cf-411e-a0a3-429a5e662f8b", "comment": "Malware payload (Mirai)", "value": "d35f1c813218aa342662d990e58fb70084a4ca3196b18e8082905ec90e462d9c94134439db458749c7e5a0aeb2ba9cc5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646841478, "uuid": "a99b9745-38e1-44b8-a350-b6efa8aceed4", "value": "T1B9435C4273180E47E1925FF4393F17F083AEE99022E4F589690FDA568235E77058AF99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646841478, "uuid": "3ee63f76-786c-4e32-ac68-0fb0154a19a0", "value": "768:DTGyz5cN6SYrPWDND/yzRYHceSaF+Yq8xP1GH+GIkx7skKtZATrAs2FXMEE:DC6MND/wySaF3EH/px7sm8s68", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646841478, "uuid": "fec52aaa-b246-4f38-a62c-cae9342f6dd9", "value": 59108, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646841478, "uuid": "d22bb826-2aa8-4ace-9baf-b80d1e41936d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646841478, "uuid": "f0fa7078-1798-474f-9337-174880f9bb45", "value": "0ff3ef4518907ea87b14aae0282cb423", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80991b84-9fb5-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1646836243, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646836243, "uuid": "26192136-49b4-49be-88fa-528640972e2c", "comment": "Malware payload (AgentTesla)", "value": "f2bcf4e904aed379173f7fe5f8a441b2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646836243, "uuid": "e7b5f1be-a10e-4484-91e0-c2ff3881a2a1", "comment": "Malware payload (AgentTesla)", "value": "655f2ad1ae7071367a528a9e7840fc33fd0f342115378f83e6b286d8dc90f36a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646836243, "uuid": "1d4eb433-49e7-4dd2-a69b-809574a39808", "comment": "Malware payload (AgentTesla)", "value": "65ab24c54bda70311342a634b7a86a8105c35d96", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646836243, "uuid": "f27b4a01-8b70-496d-803d-e6630e9079f8", "comment": "Malware payload (AgentTesla)", "value": "3f473a185ad0d8030d61d440923772eeba739b444904daffd8b09dabacb84cd9d2f3f9240c662b53daaa0aa470f00705", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646836243, "uuid": "0bb9e19b-1a18-4ee5-9669-67a814f09750", "value": "T1071412A8B62CF6BEF162C472044A570BC0B8ECCE35265BFA17E53146067C2DF512329E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646836243, "uuid": "90b6f491-8234-419f-aa3e-7ce51047e66f", "value": "3072:fEGk9jdsU3DnZ1j6NI+0Jhn7EQwQMqE0snf0tqeiapbvTBT8TjHCvBXidlD:sGijF1uNwb7KQvsnleiapReRlD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646836243, "uuid": "314187dc-259e-453d-9726-1ccf091043ef", "value": 191272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646836243, "uuid": "9a514402-7159-49f0-a5ca-473f4d757319", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646836243, "uuid": "42f287d4-ec0a-490d-acd8-dd8f12d2777d", "value": "2022-03-09 PO-67289.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "874f3fe6-9f82-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646814350, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646814350, "uuid": "62a0e67c-98dd-4da4-9e67-05a2f52a99f1", "comment": "Malware payload", "value": "832d6a93001d8099bc238cddfca5e976", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646814350, "uuid": "9e815b50-f431-40a4-aaac-3dd8793904cd", "comment": "Malware payload", "value": "656639a454677ba5f73444228637ef2dd3fac47dc6de1c4611f8b6fd806d54db", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646814350, "uuid": "681a57ab-1f2c-46a0-827b-b04ad86e8fa0", "comment": "Malware payload", "value": "0b7d63a4f160d5fcd0cbf2336d79403c5bd3f846", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646814350, "uuid": "dbd5f1a1-1978-4a56-8deb-0321dbfb8635", "comment": "Malware payload", "value": "14637559a64eea00a68dc8149f2fc96fbea23c1eda7a545e4b60db1f78bb694969a72b85665621e097bf910885b44a00", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646814350, "uuid": "176fcbfa-aaaa-4640-8b62-54e79daeb9cc", "value": "T1AD72C0E918B8F6E4E873C2B2262BEEDE551017E0F7C2944F1472C271EDA7823555E648", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646814350, "uuid": "3dcd15b8-351e-450c-8011-2859a135d85a", "value": "384:MjW7BHirDMBcUhP3pU3wjVDHS//sJFbxXzDU9hWA5hL:QWNqccKhgj//mRJzDUzfDL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646814350, "uuid": "2e722a7a-8156-48ea-83de-bad05b608415", "value": 16476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646814350, "uuid": "65cd7c31-6c07-4de6-b6dd-3bf9de241f3c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646814350, "uuid": "a7114a50-04ab-45be-beda-bac15f88409f", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f6b9085-9f9d-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646825933, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646825933, "uuid": "c2fbb25e-f9fd-468e-9707-bf4b5c4a6dd1", "comment": "Malware payload (Heodo)", "value": "32ecc1906122359643effae2aa52fb44", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646825933, "uuid": "d36fd209-376e-42ab-b4e7-e73578575e36", "comment": "Malware payload (Heodo)", "value": "658a66d47934fcb1da6ef34d2ff45e41f878820ff262cba3f7b7876e85523d48", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646825933, "uuid": "7acfb733-71e1-4b9d-97a8-22f799ef80ed", "comment": "Malware payload (Heodo)", "value": "5145e6fb5d91341d7883893cda60162108fe7dcc", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646825933, "uuid": "d0bce561-8ed2-4d4f-84f6-553de3cbbf28", "comment": "Malware payload (Heodo)", "value": "b384253a5b73ecbad81faedd2c685622e4b40bab9f8b2229d546fce99cdc211d6ce2cb1795f9eb805b5faf8df9b4e81f", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646825933, "uuid": "afd7622b-e8e5-4128-8e35-1710e7f5a268", "value": "T1BB23E03CA042FA1CE266797D920C48E6960D21617045A56F3A0C7F6D2B869E70B1F7EA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646825933, "uuid": "8682eb94-bfd6-4b7a-90c5-e94df1b0fecb", "value": "768:TO+CAEWvxRc3mlkKDNWBA7rTj+RYV8Q0RuVBR2jPrtysHRX0AOBAa:T7O2b8QkKDNck01u/R2rZyjtBl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646825933, "uuid": "ec9588cc-534f-4993-acfd-92417dc38c39", "value": 49573, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646825933, "uuid": "a34d6c75-5d9e-4717-b8f8-78c5d8f5ea80", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646825933, "uuid": "b8906a66-1424-4da8-a035-3d0f41940978", "value": "22_1.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7dc060b-9fc8-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1646844604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646844604, "uuid": "85bb56ad-e740-43ab-af58-ef2db4556ae1", "comment": "Malware payload (Mirai)", "value": "331c64f46aac03e75da13f4739492969", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646844604, "uuid": "a45c2ae7-5ae5-4e9d-9f41-838c3e2ab5f3", "comment": "Malware payload (Mirai)", "value": "6618b9b96303ce5e098d06d388d816d79d3329e88e81d17cad0c2d0b2d634567", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646844604, "uuid": "a6d889f4-24ab-46c0-a1ae-08a1bfbc6f2f", "comment": "Malware payload (Mirai)", "value": "de3532e0530cebb34ec77c525c191232f92d10e7", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646844604, "uuid": "00b9efff-128c-48c7-becc-abf3b94f1a59", "comment": "Malware payload (Mirai)", "value": "9985821e8976ce20560121802c8fabb9e277c59d1b1103136c0219bf9d84d937f4d312d01c2da14264ce2e97638ea03a", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646844604, "uuid": "2342e04a-3c82-479f-9f2a-23ecbba27b4f", "value": "T103E35C46EA808E03C4D61776BAAF424933239754D3DB73068D28AFB43F87B9E4E67505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646844604, "uuid": "3049d903-7cdd-4533-b67d-51cedd78da24", "value": "3072:zv77jnmI47aSDV2u4AUDjNLPMvEn3ExYM/9QzjTf:73yj7aSDV2uJUDpQEn3EmM/9QvTf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646844604, "uuid": "6550f835-812b-46b3-adaf-c5a936400b1d", "value": 151771, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646844604, "uuid": "08d9b162-9876-4a02-bd2b-4d91a71b61c1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646844604, "uuid": "42c116a7-bc18-4197-bd74-3073c190b476", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7dea42bb-9f84-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1646815193, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646815193, "uuid": "e54bd3db-79a5-4e45-876c-ba655798933b", "comment": "Malware payload (AgentTesla)", "value": "cc08371636ef0504aa2c2ed926ef112a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646815193, "uuid": "331758a4-9de4-41a2-8db1-d6d2bdb0bcc2", "comment": "Malware payload (AgentTesla)", "value": "6667b878761050adbdfb23dda22335750b7b79277dac7bc854f64f9885a7c42d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646815193, "uuid": "7efce59e-3ab1-4bab-9d85-68e93b33748a", "comment": "Malware payload (AgentTesla)", "value": "da6ec44edcf15a88b3ed4c38d6a447e54831a5f9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646815193, "uuid": "2b2f1d9f-6db0-4fb5-a5fe-5e40a96aa00f", "comment": "Malware payload (AgentTesla)", "value": "19c369264796bcf012498e72f26dcce2462b3c8b561acd12c08723984dbcdae3757f93aa4ac5565ddc001d7a483dc0ea", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646815193, "uuid": "6c193e12-9ba4-4ab8-93ab-1fffc796a81b", "value": "T1DA942371B31B4D3BFA535DBB65127D4E24E73728488C563FAB0DE31A22D2A8C3807865", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646815193, "uuid": "1cd2f45b-2e10-4756-ac06-03f146979df7", "value": "12288:BpwsASLzzVNYJtwS1h2QgQMPg94JlZhiJbm8nDTD1AnMP:mk6tV+npPg94jZoJS8nt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646815193, "uuid": "a54a4935-2e20-40dc-8747-c1eee65501c9", "value": 444973, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646815193, "uuid": "b435c824-068c-4527-9cf1-24fda09001bc", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646815193, "uuid": "059e1772-7984-4718-8336-dfd8f6157f9e", "value": "NEW QUOTATION.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12fb8dc5-9ff1-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646861829, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646861829, "uuid": "a69e530e-b295-4c10-9e68-27aa931f9424", "comment": "Malware payload", "value": "d2d90c6a87b6e30a7a81d4c575e622a3", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646861829, "uuid": "8543f720-af07-4eca-80f6-09b0a425abf1", "comment": "Malware payload", "value": "66e235ec8e7c006385c09e09a68c583036ac099254ae69ff2596460e43b1ef8c", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646861829, "uuid": "0473f02d-63d6-4821-ba35-360c2cf1b208", "comment": "Malware payload", "value": "bfae3e7298639179d326f1f4c11d087c73672ee5", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646861829, "uuid": "21060a99-5dc2-4e7c-baf0-d208d1b0c4ec", "comment": "Malware payload", "value": "f1ac16b925e1bce58d43c043e9b93acf066fe24a8999e9b45c1e7c308ae0ecfe549575343b831a5682b13bd341820881", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646861829, "uuid": "88394748-8299-4419-8070-734d3b77352a", "value": "T1CF156D113781C037C11B3C3286AE937E62EA9A314FA5E6875F9475BD8E345C2DA3DB06", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646861829, "uuid": "ce38f3bb-3ce1-4f21-9474-bed4310ecca8", "value": "a517173f90c43414bccc160c37653529", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646861829, "uuid": "d1b86d2a-4f73-4a75-97cc-f3e533120363", "value": "12288:4mZ2fbGh8Nggu3uTkIKD56pInvq0fPJ7/2fdwVW4SfPje88koKiaCx:4Bu3uT5KUpInvPfodwVW4Sff8kiaCx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646861829, "uuid": "f3d9fea5-c358-43c6-af4a-4fcfe4e9de67", "value": 956416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646861829, "uuid": "b9af3fd3-b458-4e0a-b4f5-e52551c16089", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646861829, "uuid": "6617c33c-2cc1-4f86-9d44-36c18a79f336", "value": "emotet_exe_e5_66e235ec8e7c006385c09e09a68c583036ac099254ae69ff2596460e43b1ef8c_2022-03-09__213702.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ea29f10-9f9d-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646825932, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646825932, "uuid": "e0fb7d59-056f-4ebe-9f1b-0373abb35026", "comment": "Malware payload (Heodo)", "value": "74f9406fd08ef9cf8ada7b132c45dab6", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646825932, "uuid": "0fe17e22-0f96-41f2-b3af-8777bafb1db6", "comment": "Malware payload (Heodo)", "value": "66e3964973424f572f31e8aca45c631520a02eb59e1f239f34dc12d53eb3a27a", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646825932, "uuid": "430c0b6f-1ebc-43d1-9163-7823d4bb3d68", "comment": "Malware payload (Heodo)", "value": "bf758b2628c0228f9eecfecaf0e6c076cbda5b70", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646825932, "uuid": "3b08b0cd-a8ce-45e9-83cb-0d07d934cb09", "comment": "Malware payload (Heodo)", "value": "41d78043f33665fb5286478e4d4125e7e627cb67f1e768afa54e8ae41e9f7c07ab0c1975e68ac9bbf55223c108bed751", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646825932, "uuid": "ce7e66a0-5f36-4675-8b88-1bf85f33ef14", "value": "T13823E03CA042FA1CE266797D920C48E6960D21617045A56F3A0C7F6D2B869E70B1F7EA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646825932, "uuid": "4ac3c6b9-0124-4a5a-b7b3-91b18d96804e", "value": "768:3O+CAEWvxRc3mlkKDNWBA7rTj+RYV8Q0RuVBR2jPrtysHRX0AOBAa:37O2b8QkKDNck01u/R2rZyjtBl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646825932, "uuid": "e5da7a5d-25db-49f0-b026-f9bf91c78d88", "value": 49573, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646825932, "uuid": "0b043144-c15a-437f-bc09-c313c8b23c71", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646825932, "uuid": "5963feec-a08e-4b40-a698-9a7737d39879", "value": "133.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64c000fd-9fb2-11ec-9275-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1646834908, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646834908, "uuid": "ce8ccaff-2fd0-473a-abd7-95cce36b6880", "comment": "Malware payload (SnakeKeylogger)", "value": "122796f12eefeb286badda96a39ff638", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646834908, "uuid": "29a3f135-40c2-40d7-aebc-58adc87d7bab", "comment": "Malware payload (SnakeKeylogger)", "value": "67529e3b45f23d2155ad4cc5980c484035055af312af3c5e53ab9083061a1c3a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646834908, "uuid": "8be26416-d6e5-4b31-b0ef-bbffed625ad7", "comment": "Malware payload (SnakeKeylogger)", "value": "db66080820b699fa2a5c95a92f4e29b759416694", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646834908, "uuid": "20f049fe-2eec-42d9-8712-5811ed94d9ca", "comment": "Malware payload (SnakeKeylogger)", "value": "ae4f14049b3c43caab1a01e834771d317ba3a744062c67ab73c9f762d7e9c81a7fb248df5d4db5eb7f603d739149b0eb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646834908, "uuid": "3683b161-0155-4157-9455-82e988f8313e", "value": "T1B6259DE229EF401DF377ABB12FC8F8CE996AEA73151A30DB11521B768523A40CD61735", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646834908, "uuid": "f5dbda98-28ef-491b-9e85-7f7903bb8579", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646834908, "uuid": "5facc444-3609-4e51-889f-121cdba37699", "value": "12288:u4Zt3Zy3WD5kPs13Mpiah7nCPMf39gaRngI7So1i9Yfh/XQ3wM+JNDZ3gGgqX4Tv:pD5kU13zu99Rio1o+PZvf4G4Twih", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646834908, "uuid": "14e8ef6b-eb7e-4ed1-8149-66e030a41d4e", "value": 995328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646834908, "uuid": "f2c106a5-e945-43f6-82e8-412bccd049b7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646834908, "uuid": "dae3251c-2f3f-4308-8c96-e89e4f62b896", "value": "Scan_Doc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df840bc9-9fa4-11ec-9275-42010a9c0029", "comment": "Malware payload (Arechclient2)", "timestamp": 1646829101, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646829101, "uuid": "87ea7a99-98a4-46c5-bffe-77acc8885d23", "comment": "Malware payload (Arechclient2)", "value": "d92c909aebdd752fba9908290c71be63", "object_relation": "md5", "Tag": [ { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646829101, "uuid": "589b7785-b162-4ab0-a0e1-acc362faa364", "comment": "Malware payload (Arechclient2)", "value": "679ce212bdc0bf1189cb0468b10ac74bae284e7d1f4bb14ec3160b83ee2a550f", "object_relation": "sha256", "Tag": [ { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646829101, "uuid": "4070ab9d-865f-45df-a2ae-fe7fe5bd42c5", "comment": "Malware payload (Arechclient2)", "value": "95290b2db7d493a1212690a688fd49fced65b41a", "object_relation": "sha1", "Tag": [ { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646829101, "uuid": "033cc9e3-a6be-45d9-8a27-54e9415ebf88", "comment": "Malware payload (Arechclient2)", "value": "1b4d03cd4c9c68e03c23d1d16dbca7b1a768ee304272f1f5d5fa69004fd15f08d95ecb876b58227e7352c4936500c692", "object_relation": "sha3-384", "Tag": [ { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646829101, "uuid": "343dfb91-9016-4e8b-8b88-3f6c2912af63", "value": "T104652323BC854679E1A31271AEAE3F782638AD55072D15C353D435A56FB82E3BE3C306", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646829101, "uuid": "7a9f1726-2061-4ff6-b436-8dec7e640124", "value": "b2493db817182247545e99985dfeb424", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646829101, "uuid": "4a59f0e6-ade1-4335-8d66-0e2c33d8420d", "value": "24576:FClRwclTbhV0tkO+7DaqeedWuASAd/KZqtKo8W8I5qBRopJPRU0IA:cwcBxOJDeYSi/oqtXv5MojG0V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646829101, "uuid": "63e66f3f-268b-4393-b388-2078bbb30215", "value": 1453355, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646829101, "uuid": "419a1566-0a63-4ab5-9f65-4ca4481f8a2c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646829101, "uuid": "3c30aeed-3956-4a07-87ee-eb96c47a52de", "value": "traff.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec9d6f98-9fbb-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646839001, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646839001, "uuid": "77ec74f8-febe-4a37-9405-4b4ac0589676", "comment": "Malware payload", "value": "4d9bcd6b3bfd115b9ed32515c2dd19da", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646839001, "uuid": "1089ee19-a494-4059-9412-8c6adb39ab95", "comment": "Malware payload", "value": "68280e79fef4b3ed2118343cb515826766bdcc41521e20a6a4d87036330956ff", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646839001, "uuid": "c54ad94c-9638-4e6f-a009-f3c3709b3b47", "comment": "Malware payload", "value": "304e2c6aeae991bd93db2c407527b41ceeabf254", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646839001, "uuid": "c80ef0db-296e-4f92-baf2-db9df7a0f8d7", "comment": "Malware payload", "value": "a348b95f76b9e7d8068345e5254ac09e394b0e60bc0f351da085901fcc6a3c113d258be7151edbc64a3561d075920868", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646839001, "uuid": "c1338cf6-643a-4b3a-9882-3bdc829f02f4", "value": "T1AB168E56A2E400E8D9BAC178C64B9917E7F178190370EBDB02B1526A1F23BD16E3FF54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646839001, "uuid": "13c31a50-02f6-4527-9d11-1644a37fb126", "value": "98304:/RLRLj41OH4wAIOF+kmcIxJr+fx3k/sc37gz+li0pjYl:nj417x3Msc8Kli0J+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646839001, "uuid": "6c433d47-7403-479c-a253-2446c57e7067", "value": 4197323, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646839001, "uuid": "432bb8cf-ea2b-40b7-8f0b-5911a0a8d628", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646839001, "uuid": "a3832a3d-88ef-405f-b43c-cd97aefac9ed", "value": "4d9bcd6b3bfd115b9ed32515c2dd19da.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa72599c-9fa2-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646828153, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646828153, "uuid": "53c2cbbb-af60-4231-9732-44836abf9b9c", "comment": "Malware payload", "value": "829775bde5f5559e2948224d8a4e5ef9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646828153, "uuid": "6a924a3d-4b03-40ef-97ee-68bf504b76d6", "comment": "Malware payload", "value": "686d56d6a2903bf7b2f9710f308046a91f5f9082db14a7470f93a59e9939ec4c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646828153, "uuid": "04278228-9882-4746-b1bb-b1f22c28875a", "comment": "Malware payload", "value": "6630a7aaafcb5bc47240ebdbb4233abf5f353ca8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646828153, "uuid": "ac10f120-2f6b-4c96-a6f8-d8be4e9ad54a", "comment": "Malware payload", "value": "ae5608898e6647d03f61f36efcea035076473aaee56ca393b54b9fcd2225fa2651fa8e736861da55a60c10126078361e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646828153, "uuid": "98059209-3067-45cd-90e3-71eab839e3ce", "value": "T1B4B30906214FB7B5CDE646B99BB0F65402E36D07FBB39A397014FF1834BA72698520E1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646828153, "uuid": "22ca5c9b-1f42-4d9b-bb20-fbc66e61967d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646828153, "uuid": "180cefaf-4ee4-4b6f-aa87-f58349022e2f", "value": "768:yeKhxSQtiBv0b1WjiZ1ONa+pSPPZgcd+:yxaQtFb1WjiZ1ON5SP2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646828153, "uuid": "ce8398fb-19a2-4c67-9c46-113233f664a6", "value": 110592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646828153, "uuid": "fe01c032-bf71-4eac-80e0-fab81b7f87a7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646828153, "uuid": "b71be61d-a731-408a-a035-f2c40c6ac92e", "value": "01.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d8ce90d-9fdc-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646852801, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646852801, "uuid": "7ee96801-65c3-45b7-8a04-cf13d0ae5caf", "comment": "Malware payload (Heodo)", "value": "27bbd16c40a0189bfeb51195668bc0fb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646852801, "uuid": "614b6069-3d9c-4b7e-ba08-07beca69b839", "comment": "Malware payload (Heodo)", "value": "687a96f837203a4fd7692b11623128ef1a7af075b779094d36a41a38e2fda49f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646852801, "uuid": "41bda989-9cfc-44a0-8d4d-50eff4e2d551", "comment": "Malware payload (Heodo)", "value": "51bd5bd46919cf5c4a9388ef89cb4c121bb4209b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646852801, "uuid": "3c941080-2abc-460d-a576-3c25701bf595", "comment": "Malware payload (Heodo)", "value": "eea2f0a5cbde29c53fe5bfa182c49dacd34669239bc48134a3b4b1efe2c719c3a7908cd9aa777fcaa2020cf84e833b9b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646852801, "uuid": "e5058d02-d1ed-4599-8737-7bf7c57cc491", "value": "T1E6257C107E8A817EC71B85B30836676D6FFEAB204B6CA1CB478175ED2D316C29B36705", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646852801, "uuid": "36eeea14-0952-4c5b-b215-c5e7ac651c3d", "value": "087c9809507dfca4c3283e6c7539e91c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646852801, "uuid": "d49c5b0b-430b-4e4e-8f7a-1ecdf9ea4758", "value": "12288:cR5SOyRHiA6m0OcElbzt6JtcS1j2xKkr:cR5SOrKlbzEtcK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646852801, "uuid": "a63600b7-e0cd-4d7f-9a7a-68fb3a342817", "value": 1040384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646852801, "uuid": "53c268d6-d5ca-4f9e-80c0-4c6bdfa4592e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646852801, "uuid": "84ce8472-9f86-4ef7-9d51-b56c79138e30", "value": "27bbd16c40a0189bfeb51195668bc0fb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c14703f3-9f86-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646816165, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646816165, "uuid": "26884403-0939-477b-b8d4-bef6f53e8450", "comment": "Malware payload", "value": "9c3316a9ff084ed4d0d072df5935f52d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RURansom", "colour": "#71CD12", "exportable": true, "hide_tag": false }, { "name": "Wiper", "colour": "#614E92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646816165, "uuid": "36d8e521-25fb-4e84-b370-deb763ebf0f7", "comment": "Malware payload", "value": "696b6b9f43e53387f7cef14c5da9b6c02b6bf4095849885d36479f8996e7e473", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RURansom", "colour": "#71CD12", "exportable": true, "hide_tag": false }, { "name": "Wiper", "colour": "#614E92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646816165, "uuid": "e4a5f508-a050-405c-983f-15438c37a1b5", "comment": "Malware payload", "value": "c6ef59aa3f0cd1bb727e2464bb728ab79342ad32", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RURansom", "colour": "#71CD12", "exportable": true, "hide_tag": false }, { "name": "Wiper", "colour": "#614E92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646816165, "uuid": "eb05946c-790e-41d4-a27a-fdc8b48a6e1d", "comment": "Malware payload", "value": "461ebabc60c90f89ec193fea6199a3b805a7be45fad8235e7dbaa1903ef2726e64fa89d8306d4f4efac1cddc76e1e2ec", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RURansom", "colour": "#71CD12", "exportable": true, "hide_tag": false }, { "name": "Wiper", "colour": "#614E92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646816165, "uuid": "c8ceb61b-c6ab-46dc-874a-1deb93b3c255", "value": "T14854238611988424FF7EFD7C08E26ACE2076E30BC40BAF5A9D031C29973B3579676536", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646816165, "uuid": "5c392571-616a-479c-a099-81297181c58d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646816165, "uuid": "2ccd82a7-0042-4cdb-b805-15b704b09d4e", "value": "6144:5xvRZVLlfh7rZthO+JjkuHEEAt/wz/60baxHU:JZdfrXg+JwuKt/S/605", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646816165, "uuid": "9565fe4e-c1ff-4b55-bdac-bc6723e217c4", "value": 299520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646816165, "uuid": "31424092-2577-46fe-bd9a-4b90d84f6a59", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646816165, "uuid": "ed85a81b-be43-4836-8fbd-e061738b7d46", "value": "696b6b9f43e53387f7cef14c5da9b6c02b6bf4095849885d36479f8996e7e473", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df95150d-9fa5-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1646829531, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646829531, "uuid": "6d6caaf3-8532-44b4-a265-fc71a42eef1d", "comment": "Malware payload (Formbook)", "value": "400a077d32f8c542b07e4dc2229d1583", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646829531, "uuid": "d82b32f0-a0ce-47ba-b984-77e9c547a8c5", "comment": "Malware payload (Formbook)", "value": "6a68426f18f239950d5bb0d82223890b44ea10de5a5fa83294457dd3dcdc5068", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646829531, "uuid": "658704f0-4afd-4f21-ac08-ab685dd1abd4", "comment": "Malware payload (Formbook)", "value": "3389025f571b28d42a340275e50c60f674a8767f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646829531, "uuid": "b00a2f78-4c9a-4087-b727-f4577f270d9e", "comment": "Malware payload (Formbook)", "value": "659c7e0a25977a8facaa18826cb304fbed482e155d3323f82742396fd076231ec025607348bec8a9da0a1515986e3acc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646829531, "uuid": "4b6a8247-2d38-4a5e-9f56-d62275564407", "value": "T18325AEE229EF501DF377ABB12FC8F8CE996AF973161A30DB10521B768423A409D61735", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646829531, "uuid": "2b07810f-62d3-466a-a13e-02bc9608cba5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646829531, "uuid": "3deab12b-ebb9-4713-a29d-314855b1e036", "value": "12288:M+nZt3Zy3WD5kP+nmdrAIQd6hxB6fzwBm3zMhX99Cb5LRXbErnPbF+jnd8luiDec:xTD5kVtAXd6fICkWYNLRXgR+jndUt9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646829531, "uuid": "396c730a-62de-4ec6-9843-2f8dce1aba4c", "value": 1025536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646829531, "uuid": "339afbec-fbca-446e-9a86-3ae832155332", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646829531, "uuid": "09894def-9d7b-4ee2-9736-b5f12824f880", "value": "Outstanding Payment.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d9f6b37-9fbb-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1646838735, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646838735, "uuid": "442d0557-ffe1-49de-afe9-aa107b6acfab", "comment": "Malware payload (AgentTesla)", "value": "c45b60a00db634ceb5cc84f684f100bd", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646838735, "uuid": "d96bfa58-9d5f-4afb-b611-a312750e5b3f", "comment": "Malware payload (AgentTesla)", "value": "6a7cd2f31d8f7b8e3d60f669de1dd0af9a68e08857210d8797f21a3ec7864de9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646838735, "uuid": "32b9d8c0-e1d1-41f7-8821-1382ad051016", "comment": "Malware payload (AgentTesla)", "value": "1d62de031e4daf73e147d2593732e35ae9e8ccb0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646838735, "uuid": "00e15734-b3e0-40b1-a46f-c7c9614c729f", "comment": "Malware payload (AgentTesla)", "value": "06cfe0a57c7142bf11de54f4cb372c1e170e79822b043c69101de1eeca3c446c991fe4efc73412751c743e552b16c40b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646838735, "uuid": "bbe0757d-b375-47a2-9ab7-f45ae7d0b0d0", "value": "T12D25AEE629EF505DF3379BB12FC8F8CE996AEA33161A30DB10911B768423990CD61735", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646838735, "uuid": "36cbb13a-2389-481a-98b4-db8a91c1a30c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646838735, "uuid": "39fbe3b8-f65c-46c0-92bf-b2cd1c28ca69", "value": "24576:XD5kN9OgHDkHYisIdY6eSnIhyjixPuuI7I:XD5kygj7isId9IE8Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646838735, "uuid": "6d993190-f8a1-4c05-92a3-f9ad9ebb17ec", "value": 1022976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646838735, "uuid": "67ec777e-80ea-43b0-b680-e8a828064366", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646838735, "uuid": "bdf3ccba-7489-491a-9d4a-db76bc1d49f3", "value": "DHL Receipt_AWB2045829822.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "932d359d-9f9d-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1646825966, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646825966, "uuid": "53e6c2b1-5c91-48db-bda9-7ab0bb8a505b", "comment": "Malware payload (Formbook)", "value": "66c8a4ebc7cc3e2a78b7aed7047dd281", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646825966, "uuid": "114b9555-f791-492a-b627-a1629ccf1df3", "comment": "Malware payload (Formbook)", "value": "6b218228e28f1578657120ec8c170da40da3f826778977082d8855ddbbf31e28", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646825966, "uuid": "1a1ba75a-bbc2-4130-b890-73e2fa913138", "comment": "Malware payload (Formbook)", "value": "f980fcbda4bcb6ffe91d7e8176dd0498628cb977", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646825966, "uuid": "fc939852-be74-4775-b5c3-239774b4aed4", "comment": "Malware payload (Formbook)", "value": "4c2eac257f17269d7686e059cb592429c5a6cdd4e4bb5ad0e0c4931530d7a8f3b0c9a4aaaa2a1e95de64a3a95b038577", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646825966, "uuid": "ccc30a76-3c6d-4ccb-a132-9169f075b073", "value": "T131C4E08EEAF0945EC9F5473E09B28934A5B7FFA44A33574DA68C7BFE293319D0144290", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646825966, "uuid": "75d83f4e-c0f8-4cab-9342-0e4bbdb99f72", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646825966, "uuid": "4eeadb98-de02-4f5e-9364-370e102d1cec", "value": "12288:isNB62FhVm+1sXSTB8no2VHjNFPwgpM1mrA5:xi2FhpByhpMUM5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646825966, "uuid": "fb47924f-c9c0-491b-ac13-bf52cb38b8f4", "value": 550615, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646825966, "uuid": "3a26b98c-1808-449b-9734-585c56446cec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646825966, "uuid": "e8649612-3df9-4aff-93a1-941632ab8a5c", "value": "Ref. No. MS-DGP-220137.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "601dcfb6-9fbc-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1646839195, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646839195, "uuid": "56a10225-6660-4647-ba4a-98d4323c2831", "comment": "Malware payload (AgentTesla)", "value": "5b52f469da301803656f21f4474b42b1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646839195, "uuid": "2d3cc9e8-e6b7-4cc0-a9f8-8f46cb291277", "comment": "Malware payload (AgentTesla)", "value": "6b6c08ecdb37ddee7a920a001df93f63d171e4d337fa1318ce891457024d48b5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646839195, "uuid": "796a43ae-3087-49d7-a2ac-5fb9ca95dcfc", "comment": "Malware payload (AgentTesla)", "value": "aeea16cec13870ee9c1c0e2b741e6910bafa1b88", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646839195, "uuid": "e1487bce-9973-4010-b960-d9ba28f5bae6", "comment": "Malware payload (AgentTesla)", "value": "e7c6fccd2dc988c8a516650c6adc6f1cc4d5a36ddc68b7198124fcc2be735c5afeb971fbde2a430422d67ca607ddcef4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646839195, "uuid": "85aefc85-470a-4041-a6d9-789d6c5a5244", "value": "T1C835BFE229FB501DF337ABB12FC8F8CE996AE973151A30DB11521B368523A40DD61736", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646839195, "uuid": "bdb2a1f1-8014-4bf5-b18a-223d1a4c0323", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646839195, "uuid": "5300ac6c-9082-40fc-a810-79ea1b1898db", "value": "24576:zD5kierpUHVDyhO2AGxrrPJw8F1euhQ3zvbXWVEDJo:zD5k3pw4hO3GZ9w8cXGVEDJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646839195, "uuid": "065c6342-88fa-44f1-b48e-b7c93546351e", "value": 1064960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646839195, "uuid": "e10915f5-8006-4f63-aa24-8be8d2985863", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646839195, "uuid": "fe647526-df52-49ef-a1a9-454f6db76016", "value": "csUSEj6WYtpD9YY.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "507f1b70-9fb8-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1646837451, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646837451, "uuid": "02c5eaad-4765-4e1d-a075-351903cb1d9a", "comment": "Malware payload (Formbook)", "value": "706c59386083f1d1fe33548e36340674", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646837451, "uuid": "8768920a-3f61-4cfb-9965-b914338702fd", "comment": "Malware payload (Formbook)", "value": "6b924ea1be631dac92121ff420d3cab7713589141e68c1792853cf1eea0f833a", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646837451, "uuid": "2599a319-9cec-4fd6-802c-33d277ea385a", "comment": "Malware payload (Formbook)", "value": "a5cc858d6c74a49eb911159eb01c1a9384d6f091", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646837451, "uuid": "5265de05-ab06-4559-962f-80c3c72548f0", "comment": "Malware payload (Formbook)", "value": "557c4070a3d3e642931af1d8f35931b8daf27680985f5de9e61a3e1ebd6047725183c771d9057f235643009785379dee", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646837451, "uuid": "ebe2152e-7a3d-4840-b498-17c521ec9e0e", "value": "T1E214121B2AA44C90E27F1C341EDF9009035ADC466A4573EBA2D07FFA92F3C345A9275E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646837451, "uuid": "cf64d74e-a586-4bfa-b8d5-38050dae6a96", "value": "3072:/0e5yBXKWV0qDM8K/cUsloZRD/qVnjXINoHFZKRmL7Ee6J7zHDZBwSd:p6XKoloZRDAdXK0ce6H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646837451, "uuid": "74e69d2d-fc87-4271-918a-c995cc47fe5d", "value": 191224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646837451, "uuid": "99464852-6024-4fce-aa76-2664a90bc741", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646837451, "uuid": "cd339cc7-b85c-46a9-9b71-68743e3d9cf7", "value": "Remittance Advice.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3fa588b6-9fb7-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646836993, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646836993, "uuid": "09c3b366-94bf-478e-808b-05723a7ca381", "comment": "Malware payload (Heodo)", "value": "c94f6bb799c45a2fa2476ee5c74f8251", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646836993, "uuid": "04b5e9e2-8ac3-437b-96f2-c5f582e58612", "comment": "Malware payload (Heodo)", "value": "6d55e6f24b4437d7f4824f89f019f0bb320bcd46c5435070e7311c1dc55516f3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646836993, "uuid": "10dcd7c9-1e0f-4f87-ae50-c7359dec364e", "comment": "Malware payload (Heodo)", "value": "3e44e11d11053ab96f19efd984db621c58ff19ac", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646836993, "uuid": "3b36bea5-88a1-4666-acd7-9cb224e1f247", "comment": "Malware payload (Heodo)", "value": "1510356917e1437848c712761b7722fe8654a6edc16cfd24786541190b86e0642a7e7e613573a80a0b54442e4301f059", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646836993, "uuid": "491b30eb-1594-44c6-8d67-668ec2291758", "value": "T158257C107E8A817EC71B85B30836676D6FFEAB204B6CA1CB478175ED2D316C29B36705", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646836993, "uuid": "7aced394-8433-4a63-a1ad-f891b663b93c", "value": "087c9809507dfca4c3283e6c7539e91c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646836993, "uuid": "9c6bf960-b812-43cd-a1f6-745b98ac089a", "value": "12288:cR5SOyRHiA6m0OcElSzt6JtcS1j2xKkr:cR5SOrKlSzEtcK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646836993, "uuid": "41926228-8a13-49cc-ba8d-6bfe562f84e8", "value": 1040384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646836993, "uuid": "6e3bcf7e-790a-45c1-a437-fa7da5280e95", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646836993, "uuid": "d835b046-7545-44b0-bfd2-ccee4436100a", "value": "c94f6bb799c45a2fa2476ee5c74f8251", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "611571ec-9f8e-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1646819440, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646819440, "uuid": "171b3be2-193d-4c8a-b450-7d5bf48bd363", "comment": "Malware payload (AgentTesla)", "value": "8a1b3060483e66fbaca9be34d7297955", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646819440, "uuid": "c3e50be8-7925-429d-9b63-e207e6c5b691", "comment": "Malware payload (AgentTesla)", "value": "6dd5e833ca077b6c9cba5ede69b9e6497a7fb364a9007f2fd5f2767cb8a8514d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646819440, "uuid": "dbbb115a-d90b-4d5d-b838-332b54f58c9a", "comment": "Malware payload (AgentTesla)", "value": "9977d662ae9cc05f0c105a1a1ea993490e8e46e3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646819440, "uuid": "2b62cc90-2be6-4966-a959-ad179d86f35f", "comment": "Malware payload (AgentTesla)", "value": "4b66ffbf2a8722aeddc025b5f258577decaf5b2bdeecab3810f8a510f947d7e3f2bad22b204ba0435407d5045fca91b8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646819440, "uuid": "907bc399-fcf7-475f-8c8c-918eb843501a", "value": "T19474131BF5D1A937D2D68BB30B3B133DEB2A9EA4401135478366BFDB545B0AB9E40039", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646819440, "uuid": "59edd580-cd73-494b-922f-129f5fa810c9", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646819440, "uuid": "8dce7d00-23b6-4625-b458-0e1c70234ae1", "value": "6144:rGiDaeVPABcP4EOUQH5oAU2qGDy20Fv/JNYsUfe0r4qmgizRWE9mMdK:/LVIB/FUQHBDqGDypnJjv00giY40", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646819440, "uuid": "a84c21a3-ec36-45c1-ba89-5eba76eafb32", "value": 366290, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646819440, "uuid": "fb716c20-74ef-4797-b15f-3bb6265b33b2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646819440, "uuid": "e7abad0b-4c37-496f-961f-7d0b897ee1ad", "value": "INV_09-03-2022_001000054323.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ca9faa4-9fbc-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1646839216, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646839216, "uuid": "9bb486c4-e44d-47a6-9bb3-cdaf9d8a39e3", "comment": "Malware payload (Formbook)", "value": "8a554c6e3fa473162a213a8d180ccb26", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646839216, "uuid": "bcadf3f5-d700-4999-ad45-fdbb08f4a121", "comment": "Malware payload (Formbook)", "value": "6f0b9772a35ca7d4a4808e30f16b0c36bc50902a3abf8f0f4dda7bb75b0009c3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646839216, "uuid": "59d198f0-02dd-4794-abc3-c34d0af0e729", "comment": "Malware payload (Formbook)", "value": "1326319aed38bddde537f8f7f51e4ef164418ec1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646839216, "uuid": "b19005ff-dc67-467d-b4cf-45f4a937f5c4", "comment": "Malware payload (Formbook)", "value": "bd585098f4674a3739393b4134d9ff1b206337c15b339aa1092475384b948de39d81ccab0e33b5a8b9334fcced71f28b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646839216, "uuid": "06e409c9-c40f-4645-a455-29d9ce5c0a9e", "value": "T1D0A402092554D912C7C932389F7ACABA53B5DDCD0D168567A2F83F8F3AFE18B6500272", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646839216, "uuid": "f4a1c0aa-42c0-433e-8ae2-5e2fb2a3386c", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646839216, "uuid": "03dc6698-cc2d-4b1a-9e01-ef210d32e6d2", "value": "6144:wGiNlW+ssR6BjKX05IkjCqLD/ajXdxvyNFCrcQwNx4ENGmVW:nEsKXQIYCO/ajXdJ7cQwoENrW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646839216, "uuid": "96acb116-dbea-49fc-950a-cc35ed684117", "value": 479973, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646839216, "uuid": "0775ea6d-83e3-49d4-b0ca-b761b6bfd085", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646839216, "uuid": "49b0f5ec-99b5-48da-8756-6b308a84c5af", "value": "8a554c6e3fa473162a213a8d180ccb26.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc0b5b98-9fba-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1646838544, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646838544, "uuid": "d2c1dda0-90d1-4734-ad17-4d434acb38e0", "comment": "Malware payload (Formbook)", "value": "348601ee9843b206db97a5d03546a4fc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646838544, "uuid": "6157b3bc-3238-4472-ae8a-753d0128da7e", "comment": "Malware payload (Formbook)", "value": "6fc9563d971fe534d3b73811ed493784a02bab6f4a0c13362c762a33eb59300b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646838544, "uuid": "6777998d-7a39-49d8-81aa-51846782f19c", "comment": "Malware payload (Formbook)", "value": "f13ac3d7f55aec7c3f23cd887baa8842b4b936aa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646838544, "uuid": "0e5bc961-f056-497e-87a0-e4c0cce3d7de", "comment": "Malware payload (Formbook)", "value": "e1e43599897991917835fcc0f01f7d26c16c1a7811802738b82a521c1d7fd7004cb9597e934a34ed65d278eb1670057e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646838544, "uuid": "9cfa4317-0c9a-4ee1-bbcd-b012196bdfe2", "value": "T141059FEEB7E04472D1322A788C5793746429FE102F2454476AE8FE0FBF795913A39263", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646838544, "uuid": "8f10f714-3940-4910-8cc4-fc312a3d4cf8", "value": "9a2305e23c811e08425371fd3caa41ef", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646838544, "uuid": "a7c08318-cbe4-43d4-b7d8-4fce14916aab", "value": "12288:cPsyMBzW+hNm5/WWZfeApLrY6xVct+LeIzl/YRIlRfk:qsxl05/WQeApwkVykhv7f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646838544, "uuid": "46b16c0a-0575-401f-832c-3502233919ab", "value": 837120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646838544, "uuid": "02117e69-8d03-42c5-a233-09508971c9ef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646838544, "uuid": "94e7d769-cc83-4dd0-99de-4bebc5214977", "value": "Yeni siparis listesi.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e76104ed-9fc8-11ec-9275-42010a9c0029", "comment": "Malware payload (RemcosRAT)", "timestamp": 1646844576, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646844576, "uuid": "7db2cd44-3011-4102-8012-f606f6dfd471", "comment": "Malware payload (RemcosRAT)", "value": "d70776f8fe46166dc8e335cfab27ff3f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646844576, "uuid": "4fbd0204-ffef-49cb-8a70-7cf574d01e98", "comment": "Malware payload (RemcosRAT)", "value": "6fcac658bbef930bb0f7472b82c10b4fa5c7ef9fcd634687b53ef8034cbc49d2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646844576, "uuid": "f41d3948-f8c6-4b22-9c20-d5886e33dc78", "comment": "Malware payload (RemcosRAT)", "value": "5907c842fb304694039c289302348de5b41a56d4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646844576, "uuid": "2e18b111-df82-4397-91c4-f0c39e2dac01", "comment": "Malware payload (RemcosRAT)", "value": "a5908cc841d3acfbbeba5b3f5efdce0eb1850365cf7549d2ed7e9e21f7b1544147a9534ed3b40d66dd815f82780c18bf", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646844576, "uuid": "daed2d96-85fb-4271-a651-fc5cf32d2f22", "value": "T13255E010A96A503AF27E9A791BC5F86349D7BDA61600E0BE5C6CF59A0FF193D9CC0C31", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646844576, "uuid": "f13b0754-6290-4dd9-b8e7-514fe2b59410", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646844576, "uuid": "37e2449a-2a1b-41c6-99a6-d9953e4a8917", "value": "24576:FMfCxhSmqrjajBoxtjU+p2VhyC9mxMlAtnnOgSvvdoE2xJg:FdSJjqoHX6h59ar1CyEoO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646844576, "uuid": "15aee06e-c968-4349-996b-a285f2d0510b", "value": 1301504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646844576, "uuid": "278fb035-f477-45cc-a7e1-b8fa3de54df6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646844576, "uuid": "f0198737-443a-4ec3-9f69-90adc18d1c3c", "value": "d70776f8fe46166dc8e335cfab27ff3f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86a25744-9f82-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646814349, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646814349, "uuid": "028622ad-0f76-4f5b-85c5-ebf89e546000", "comment": "Malware payload", "value": "dd763b4dc86c09cdb37167e237137e8e", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646814349, "uuid": "438be854-da02-47ee-81b1-1321c15b32d4", "comment": "Malware payload", "value": "6fe8c8bba5ddafd9ed980fc0d46ca950d56765afa75380a918860475b4fba904", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646814349, "uuid": "6482c724-d8b0-4835-8ac0-668220ec44e3", "comment": "Malware payload", "value": "51ad3d63e71d8c83b3195a15e0b9485e2a9ed24e", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646814349, "uuid": "512e2ada-d509-49fc-8332-53e522a85971", "comment": "Malware payload", "value": "5534667f9e11d90699f56369492a636e43a37afdabe29317a01ce18b95b6c3a8c044ddb871a4b8a9d95f1752b5c891bf", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646814349, "uuid": "750e2eca-83f4-4b1b-8522-5c53e8329d27", "value": "T17B82D0284C9CCBC3E110F63B4783ED782D71E275034ED4D3459A7BAA302BAE1127A796", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646814349, "uuid": "8917534f-c875-41b6-b364-941f8b2262c2", "value": "384:CU4y5mEyRYvCtKBYHpCYXvdV6YBveFDvDKV+9v2ox22eZ:vN5mE0YvAwUCivjMFve+vE7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646814349, "uuid": "de0d669e-f595-407d-83ab-f548091be0a3", "value": 19164, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646814349, "uuid": "a350ddaa-2039-4967-a0d7-50ddc13d0492", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646814349, "uuid": "edb7857a-0353-41e2-921a-a6281520adfa", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21f2d281-9f96-11ec-9275-42010a9c0029", "comment": "Malware payload (FormBook)", "timestamp": 1646822770, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646822770, "uuid": "fcc9c389-b5fe-4bc6-be30-ce3974da1217", "comment": "Malware payload (FormBook)", "value": "7d743a16880cc47954dad88c31a9f168", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646822770, "uuid": "4e9eaa40-09a1-4c71-abf0-34e9d3574cbb", "comment": "Malware payload (FormBook)", "value": "708af0a1312a0b416011df2aa5d4c7aa52f4ff483e9e0f4795e0e98eddc5a781", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646822770, "uuid": "d36ab198-229a-4fdf-87ef-57399c79491e", "comment": "Malware payload (FormBook)", "value": "683742672baabff0a14e3ebedea812e8ac15ba7a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646822770, "uuid": "a1caa73c-73a6-4107-83e6-12cb80f60171", "comment": "Malware payload (FormBook)", "value": "8d21c6b0c08ea6b6da4e12f695a8641ed5209f636053579ab8934c2638d342bbd150ae45e7f27a49158ac411d190e01b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646822770, "uuid": "8dd03736-6c25-4df8-8717-ff5c0441391a", "value": "T1F2058DEDB3A18532D1331A745D1797B4A82DFE112F24544B3AECBE0E7E341553A3A2A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646822770, "uuid": "96297914-ce99-40e7-a5fc-352971959b47", "value": "9a2305e23c811e08425371fd3caa41ef", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646822770, "uuid": "64aca947-24a0-446f-9467-d93a8ec46e43", "value": "12288:cPsyMBzW+hNm5/WWZfeApLrY6xVct+LeIzl/KRIlRfk:qsxl05/WQeApwkVykhp7f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646822770, "uuid": "6f4003f8-c825-431b-825e-0cf5fb899739", "value": 837120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646822770, "uuid": "ed8bbf20-cb84-48d2-83db-45a1ba49a3f9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646822770, "uuid": "178b62d4-e1e2-4c62-90c5-a50328f21cd6", "value": "Request for Quotation.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8170aae0-9fba-11ec-9275-42010a9c0029", "comment": "Malware payload (STRRAT)", "timestamp": 1646838392, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646838392, "uuid": "bdd2d501-d719-4955-83ac-1fdf2916d07d", "comment": "Malware payload (STRRAT)", "value": "3f2e07b39051f95107ca8ba107c7e36d", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646838392, "uuid": "01b847f8-b5f4-4c04-a3d8-ef80ae062261", "comment": "Malware payload (STRRAT)", "value": "70fdb27e92e4c50cbe2c739ea15b84610a499a6c07a53cf56e7dcfed59c0324f", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646838392, "uuid": "10be2d1f-efbb-4fe2-927a-58d927721f98", "comment": "Malware payload (STRRAT)", "value": "5f3f3e88ba9cb11851a09ac31f6cbe1545b8d309", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646838392, "uuid": "a3835def-c7ac-4bee-83b9-865864059685", "comment": "Malware payload (STRRAT)", "value": "997d5da0a819b985e3eb05cc379724e078a8a725c3926505f2fa9a717a55f6b4b1a4b91baa50c603d412bd06053dd59d", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646838392, "uuid": "e2d1b84c-6947-4321-a1ed-baf1ba161319", "value": "T1FB041275732439CAD1ACA8F4BBE79CD198E218CD5A7DDF38F2E094D81292BB01524F58", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646838392, "uuid": "9090cc1d-d1c4-4d95-9163-652ddc1fb951", "value": "3072:eAkMhoNyU83Rl4+NZW2YGGDL6gnPHRqPjo0OQSQNPJL/:5RU83Rl7/k62fRy1NxL/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646838392, "uuid": "d9885bfd-799f-4662-b1e8-0976175d9988", "value": 179730, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646838392, "uuid": "ebb1086a-81a8-4907-a984-99e78e0c8357", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646838392, "uuid": "a7a35106-0e4c-4ee5-b07f-b0b22ca59e70", "value": "CA __ 00086632 __ 0509AUTH __ 08-03-2022 __ pfd.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d59c82ac-9f8e-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646819635, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646819635, "uuid": "bbc7ff72-a923-4a80-98b9-30ea248db23a", "comment": "Malware payload", "value": "37f8a062fdcc64f3d7bf7e683ac170ca", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646819635, "uuid": "e0f51aa3-8742-4c3c-b343-43873f9e49bd", "comment": "Malware payload", "value": "72db091c5f361d928bc1a3c1578bacdc9d7862a0aabcdc0a68d5ee7fc7cb8524", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646819635, "uuid": "5e1f6df9-90e3-4783-9239-b6c5f22b99e6", "comment": "Malware payload", "value": "ae2a38dddbaa838505da150421107ff71276886c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646819635, "uuid": "872468f6-16b5-48f6-a8f0-567bd92c6386", "comment": "Malware payload", "value": "a6f61a958519d398e13cb7b74783befb1c6f0289694fbc34c27ced8a7dd863f18c17b7ab1d66d95cb4fb5f9d1ffda03f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646819635, "uuid": "f63d9112-e420-454f-9d21-e7a98ed8cb1c", "value": "T135724950B78C1A32DCC7B5F754EA47A41135E5A749033B27AB887BB61EBB7CC0842752", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646819635, "uuid": "adc7724d-603b-434e-b293-d3abe261d7d1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646819635, "uuid": "19fe8979-ef2d-4597-ac5b-66aeff636a9f", "value": "192:NAVxQrBMIGxJYT1aYzXOtnpK7nNrUsn6aGetsOWzXCIJQgmDWwh09zL3Wal1Yc:NRIsTN8pK7tDn7GetxmXDBmm9vt2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646819635, "uuid": "e905f8db-dc95-4a4a-9eb9-675e8ad12941", "value": 17408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646819635, "uuid": "c7eb8375-eae3-4c7a-a9ad-7e6d0ab41d13", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646819635, "uuid": "69b78d7c-793a-4e45-9a2e-9a39c6842739", "value": "37f8a062fdcc64f3d7bf7e683ac170ca", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "baff0ced-9fb7-11ec-9275-42010a9c0029", "comment": "Malware payload (RemcosRAT)", "timestamp": 1646837200, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646837200, "uuid": "9333a028-4f32-40a0-a757-e68167d3455d", "comment": "Malware payload (RemcosRAT)", "value": "f107f07a5ffd2446a79826ae6728aa8c", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646837200, "uuid": "d631938e-9936-41aa-a3c3-42d0ccda3d00", "comment": "Malware payload (RemcosRAT)", "value": "73c74cbaa96e31d8306c43b679f3a2f534b89063cf8e5d24a41de3f5488634c2", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646837200, "uuid": "800c89b5-f404-4ab6-b9f9-e9b1d097bb24", "comment": "Malware payload (RemcosRAT)", "value": "532693a83c7c7941142e8223f13f7c9de82a9afb", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646837200, "uuid": "0742a55e-e5f5-464c-8232-882e0b4f6c8a", "comment": "Malware payload (RemcosRAT)", "value": "ad7c00725a3324c7da1059e54c904a70ecacbb4592b69ef7291fcba55dcb8099b04313964e0ca3063eba07f3d7a26f9d", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646837200, "uuid": "87cd1496-04e4-4c2d-b273-b569f92dc059", "value": "T119141205BDD9CA44FB6BDEBB8C7083E0452EFC530829FE2070827B2A1D7194B5764D5A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646837200, "uuid": "6bf5a4b3-df3d-4dd7-b8dc-6dec1cdd5e4a", "value": "3072:IzQbLn9n8MX4VzN9xLplnBMkB212qmCJ3e6qcH7tM8YoF8Ls6j/R:hbLn9PEN9nlSkw12WqWiHN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646837200, "uuid": "dfeda0aa-6317-4459-a73d-1a52240c49ac", "value": 191256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646837200, "uuid": "39ebf5aa-776d-4e52-b709-da208bdb9e5b", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646837200, "uuid": "b09f5f31-c674-4409-a581-410e1b7ca592", "value": "PO. 70030 - 20pc-po27095.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70dbe30c-9f8e-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1646819466, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646819466, "uuid": "6641176e-12b6-4b6b-b769-fe3ea27bc889", "comment": "Malware payload (AgentTesla)", "value": "1678d54113fe3d338c546266e3d688cf", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646819466, "uuid": "86624ba2-d655-489d-825b-c0e9ecf8049c", "comment": "Malware payload (AgentTesla)", "value": "73c8c51f9084ec745ddb86c9f1a8da3281b6cf5276300e3df0e32ae44b76f63f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646819466, "uuid": "cffadf1f-461a-46b6-a28a-47e74d2196fd", "comment": "Malware payload (AgentTesla)", "value": "42fc3932dfc55dbf42147feccfcce0f0ecfe0a20", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646819466, "uuid": "08a2a8e8-21c9-4fb3-9aad-082e0977a37a", "comment": "Malware payload (AgentTesla)", "value": "b29a1042b743d63b7340830f6f64c4804b00b1538558371f793e0403f8038aa97bf49f05a01d95f1dbbfd790fa55a9e9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646819466, "uuid": "892ddd45-70ff-4c80-ab95-b39d70699c3e", "value": "T1F6B42326E013F65874C599197E96CBF0CC1108CF89449739E31E0B6AFFEA11591BBAC7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646819466, "uuid": "e86b236c-f29a-4651-9537-3b95ec434dbf", "value": "12288:LH3EehWS9NEnMUEpinjL/0xleznoC1FlvtJCoO7rCOkXu:LH05MUt1noC1/1JCn72xu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646819466, "uuid": "01363ea4-bc3e-453b-ba5b-c2261d3c9247", "value": 506378, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646819466, "uuid": "fef4900b-c97d-44b3-a829-0254aaf9b56b", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646819466, "uuid": "8698584b-bf5b-4a3c-85e4-41c4c220c613", "value": "SOA.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87f80160-9f82-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646814351, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646814351, "uuid": "4e748a13-895c-40af-bc14-4f1e9596e937", "comment": "Malware payload", "value": "f1a5a993b700fe2e36f1cf063d2f21e3", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646814351, "uuid": "94221924-f726-48ef-9116-1b7863895b24", "comment": "Malware payload", "value": "73f1d61738251e6ca827345e29c7bb29dc91076d3cd860118fbc8748f0496fa3", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646814351, "uuid": "0b2b399b-a2c9-4eb4-adf4-77fcbc42d926", "comment": "Malware payload", "value": "4692bf5bb120a2648500c7581e61d34b97db2472", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646814351, "uuid": "34c0010a-c0de-4216-8625-3e8d1ec7dcec", "comment": "Malware payload", "value": "661f119823d7bff22385b08148337b62f2a1730c36175add568c87fe2208200a38919cf5d34c4b85d91e232067e29914", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646814351, "uuid": "5fa4289f-f8ea-49f1-9606-255961148507", "value": "T1FF82D09C8E3E41E1F1473D34852FC34B627B9BA1BB5F1FBA6798939503420244280F46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646814351, "uuid": "13917f7b-dc70-47cc-a9b8-a9f3bcae991c", "value": "384:wWSI/HizVwn/aENu7OitldiURVivhGkL8lcx3eahAFmH:fx/HiS/aL7fIfpzfmkH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646814351, "uuid": "a31e56e3-400c-4856-8cc8-ec9f7caa3398", "value": 18872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646814351, "uuid": "02bf61a3-bf93-4383-8a00-543a86e9bd4d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646814351, "uuid": "b2d88541-bcc8-4f07-9646-c696522e087d", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14593a2d-9fbc-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646839068, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646839068, "uuid": "8b693fb2-8219-4aba-9723-2703cc1f11e5", "comment": "Malware payload", "value": "fde49ddf8a1ee11eb6aae6a3688ed5c7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646839068, "uuid": "4f5ae2fc-be04-48b1-94d9-88ea056d1f37", "comment": "Malware payload", "value": "74d1ee7bddb0310fdb4632fe67fc47371b49d57844810927cbc4a847a9047fcf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646839068, "uuid": "815149c1-ef18-426b-85f3-7499532e6b63", "comment": "Malware payload", "value": "eb6d31d4964a6a290e094220ff5953d7c9a9301d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646839068, "uuid": "a21aa39a-8378-4f11-aea2-300783a28f6b", "comment": "Malware payload", "value": "e96c14e3b63e68053dc33901a26aeecf35294f7248be6729a1613a3061610f4bdcad63b53ca811b7aaa8fc6716968bcd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646839068, "uuid": "2b54563a-0f30-43ca-a87a-9b0f9ec1d349", "value": "T131F5017C256E5E4CF394947CB17A4EFF27A2B82F05A774F7900CB1D70AA9BD05902226", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646839068, "uuid": "f6880799-a1e2-4b78-89ba-1376bd39a447", "value": "4443ba86c457722dd58af4e4410113ef", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646839068, "uuid": "773a6796-1adc-4560-a8f6-4c8eef57c773", "value": "98304:XpEdtLiNZG93jfpSP1atPI/nRl+WY05grrY7:XpETCZ6TA1oPcnpcrE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646839068, "uuid": "4ed84c54-652d-4bc3-8223-a900a402b49c", "value": 3640160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646839068, "uuid": "8dcf1c1e-6100-49ea-b88a-0ef0908e141e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646839068, "uuid": "376c248a-3c1d-4cee-8f8a-0e5163505949", "value": "fde49ddf8a1ee11eb6aae6a3688ed5c7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57fc91e0-9fec-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646859797, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646859797, "uuid": "10ccb19b-edd7-429b-b566-e7a51119f078", "comment": "Malware payload (Heodo)", "value": "f4de40c2262947a3dbb699b6be13eb4b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646859797, "uuid": "d793b527-7599-432d-b414-b3930db2ef5d", "comment": "Malware payload (Heodo)", "value": "755738e1051d65e3374bd38bad04f1de6cda492c6d516c61a64efc4164588ba3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646859797, "uuid": "c592ec23-bf7a-4ea7-ae63-4cf1b3799a41", "comment": "Malware payload (Heodo)", "value": "fc138aea18e2f1d40a951c81204289c6bff14db6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646859797, "uuid": "dd219b25-d9eb-4cad-8368-6354a08af40c", "comment": "Malware payload (Heodo)", "value": "134a373ff1086fabe0c46538235c5030d8ee3b37b207630d3191a846740a20579fcfafdbb7f62349893f55f2ac8b0104", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646859797, "uuid": "76ba7cdf-436d-4c34-833c-85d92a5b13c3", "value": "T1CE257C107E8A817EC71B85B30836676D6FFEAB204B6CA1CB478175ED2D316C29B36705", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646859797, "uuid": "f76860e7-e4da-4211-a0e6-63f310a7c252", "value": "087c9809507dfca4c3283e6c7539e91c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646859797, "uuid": "cddee9e1-c143-4a61-b04b-eb14c88b8240", "value": "12288:cR5SOyRHiA6m0OcElMzt6JtcS1j2xKkr:cR5SOrKlMzEtcK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646859797, "uuid": "54f716e5-cf95-4ac4-9f9a-a59ad8fdbc1b", "value": 1040384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646859797, "uuid": "cc482e6b-93af-412b-a7be-8b4e63690ee5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646859797, "uuid": "35345edf-0d8e-4065-b9a1-764dcf00a759", "value": "f4de40c2262947a3dbb699b6be13eb4b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65302288-9fa4-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1646828896, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646828896, "uuid": "0d5a9fef-9af2-4eb0-adcb-6d825b1400e1", "comment": "Malware payload (Formbook)", "value": "a9ebf8a3010b405f71678ff744ed829e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646828896, "uuid": "dd272a28-58d0-4787-83ef-b1d559704f14", "comment": "Malware payload (Formbook)", "value": "7570dcedbf5cba70104a5a70d9011407550531f47c51f3f3152ab398a763d976", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646828896, "uuid": "8b18a58b-54fe-45f5-98d6-4f1b3c15e386", "comment": "Malware payload (Formbook)", "value": "82340c4724cd3c384ae86c70a235bca7ceae74bf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646828896, "uuid": "148424b6-7491-4788-aed2-9c007f82a211", "comment": "Malware payload (Formbook)", "value": "e9d5249ee811c896f34cfa0e5762e74c8aafcbd3dfd5c0a942ab40c8b2b7d0047be97cb8c3ece177cd86dd5e82c49b58", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646828896, "uuid": "d9fc302d-5a5d-41ed-b319-0afff62f9c17", "value": "T16C74234673E005A3D9260A7918F3F7D8FA7943ED154B7227D7A53FE314919C6C2282E2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646828896, "uuid": "6e13b8d7-e249-4fa6-b514-a8786b621bab", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646828896, "uuid": "6e806f97-168d-44a3-97ee-8799ffefd141", "value": "6144:rGiI1zZkoD9dNHa7NnZNOSD+R4Iqhk/aWX78EvyYUOp+:E5ZRqOSi46pX7e1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646828896, "uuid": "341375b0-2d40-4498-8fa7-30658d1bf268", "value": 345313, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646828896, "uuid": "df4b3f9e-5069-4ab0-a0ea-1870d9eeb2ec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646828896, "uuid": "4247ec45-6986-4f0a-805f-266085388c6f", "value": "tochi567483321.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b8dded4-9fe5-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1646856851, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646856851, "uuid": "81b1b420-4854-4283-82ac-2a0896ec007c", "comment": "Malware payload (RedLineStealer)", "value": "a238770cf5b31d7f686a2f1782ce0549", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646856851, "uuid": "0400c099-0bab-4ee2-a36e-86e0fcc56194", "comment": "Malware payload (RedLineStealer)", "value": "768b25432320856e6caaef88fc5ef9e1373fe7f9c02f449b0412349cadfe0ed3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646856851, "uuid": "53858846-7879-4797-93b6-f460c96f8411", "comment": "Malware payload (RedLineStealer)", "value": "cd69bd3e86d63388067a20d39002acc8ae480864", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646856851, "uuid": "337e3c2b-f562-4725-8889-58094e49a0d4", "comment": "Malware payload (RedLineStealer)", "value": "8393b028b1a64ce00988884dc7e3108b1095728363c019c90f63b3e80d691a036d68824edcea12919a7336691111bfc8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646856851, "uuid": "ac5dd4e8-cb8d-461f-988b-62bf15edf546", "value": "T133D423169FA74660EF7C513E046A8E7B3D60D88AF0C8D37703695880BE78AC6DEB3505", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646856851, "uuid": "ba78b112-2008-4326-adc7-8d936d57d52f", "value": "01ede967a9644e7cf81c4105bdcf6bfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646856851, "uuid": "ff34d171-271a-420f-9be6-6d26aa91c120", "value": "12288:+A0OOtmeUagiEkN3InsgPfFy6xlBE9p9odn6szFNkY90wsU3yTL0dt4HNZ6:ROrXz4ns4vy9oV6+uY9LsU3y304y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646856851, "uuid": "b14dc5d2-d233-43e0-93f0-ac6b2dbbd984", "value": 636400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646856851, "uuid": "c9ddb985-17af-42fa-8e28-fc45734d20bd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646856851, "uuid": "a34d5dcf-2273-42ae-a32d-f2d81ec778c2", "value": "a238770cf5b31d7f686a2f1782ce0549", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f162d59-9fbb-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1646838764, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646838764, "uuid": "6bf04165-a53e-4776-871a-2a80e6c92b7e", "comment": "Malware payload (AgentTesla)", "value": "30c1961e0a32cdc0ad24e77e794fe414", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646838764, "uuid": "5809b953-9e21-4ce9-b1b4-8af6310bac3c", "comment": "Malware payload (AgentTesla)", "value": "7799d480f93dd5ce517e084ea7907e49b1dc8744808bd6ba9c071838ee09459a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646838764, "uuid": "2773d589-1317-4a9e-9d84-30ac5a0c338e", "comment": "Malware payload (AgentTesla)", "value": "e4dea9de322b0941667e2cf4de47a8b9ce0b0c03", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646838764, "uuid": "5377819f-db7c-4547-a0f1-981cb60ee727", "comment": "Malware payload (AgentTesla)", "value": "59d174488e2ad0ddc81e91cab3914b88350c1f162bfc11c9283a86612ca8cab067df63fc21a468898e026e6cf6d9f351", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646838764, "uuid": "53e0707e-cdf9-4f36-bbcd-8164e8f1b695", "value": "T161259DE629EF505DF337ABB13FC8F8CE996AEA33161A20DB10911B764423990CD61735", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646838764, "uuid": "ced87a6e-f161-42cf-ab97-5e0adcb45186", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646838764, "uuid": "c4b7f962-159e-4a4b-b4dd-189276d31216", "value": "12288:FZt3Zy3WD5kPwGIg1kD8Hx2idlTsz9ppxDOkx++bEVV+DinmCvvB2KiI:JD5koGIg1kDY2iDsJTx3oV3n/vvB2lI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646838764, "uuid": "27b86478-2d7a-4973-a2b0-ecbc801d36e5", "value": 1010688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646838764, "uuid": "cfbe909a-6e48-40c7-b137-cfb30466086e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646838764, "uuid": "786bb93b-2145-42f6-a74f-24d484edcba4", "value": "AWB DHL 7214306201 Shipment Notification.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59b9f1d8-9fbc-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1646839184, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646839184, "uuid": "257e1703-6835-4312-a22d-7e16e8a1c64d", "comment": "Malware payload (AgentTesla)", "value": "f24c99cb2c310a85ad2703818438f0a2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646839184, "uuid": "b819e93c-99fb-4756-b914-2150ca2199c0", "comment": "Malware payload (AgentTesla)", "value": "7806728f8c13550fbd4264a3d79aa0d06c8c859d25d054b6bf433800eaf9639f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646839184, "uuid": "f7ce67b0-54fd-41c0-a391-5c33c71f4793", "comment": "Malware payload (AgentTesla)", "value": "694a044d746dd3d3eaaee1cfce42e6f5f6bc51e5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646839184, "uuid": "6e1418bb-11e1-485b-9ec7-87e93c335672", "comment": "Malware payload (AgentTesla)", "value": "faccdfb4e6776dc9dd21e87a4094dbfde8b9492323186ae65dde5d63dc9d0540e61752fc73f637a1e280fd1c6a76a4a2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646839184, "uuid": "c2ca232d-c601-48f7-8a39-84c8766f6270", "value": "T1231533DA1B7CCCB3271E3CF9C1A599CC35EC73854AD08FB222AD93A574E991598120F6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646839184, "uuid": "51735801-330a-47f3-9375-9dadd1538c5b", "value": "24576:dYdYngDqmPC9+Sk4JttO1OrFA7H5jeHRA:eSEPC9zts15Uy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646839184, "uuid": "b645bb21-07e5-4923-9c7c-6c9252b8263b", "value": 896163, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646839184, "uuid": "75ec5b95-9605-4507-9939-64dc44aaecc3", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646839184, "uuid": "e46b2e36-09d9-417a-9cd5-ac96ae0acb96", "value": "purchase order 2022.r00", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d130154-9fc4-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1646842572, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646842572, "uuid": "d454faeb-a610-4f41-a55e-c66a25473007", "comment": "Malware payload (Mirai)", "value": "0f22fba440868e4ea7311f092afcc2e2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646842572, "uuid": "adf6e101-4d01-41e4-b1f9-efed153e5e7b", "comment": "Malware payload (Mirai)", "value": "782818b6b3bb0944ce7c52a2bce8cf6eb159ac34df29abbd7513bcdeb1f11372", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646842572, "uuid": "de3260ea-7813-4113-a248-e73702e9270e", "comment": "Malware payload (Mirai)", "value": "452091fe6bf6f0041d1c496e8e72a32f13b22247", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646842572, "uuid": "1f964ddf-f96c-4c4b-b86e-2b0b98d6ef46", "comment": "Malware payload (Mirai)", "value": "d641b26bd0b37fe465ef9ecf2f2cc754b0cc5abc11bf4142063d2d6770706090074d990d9fe8429fe6e80d3dfd7bdc26", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646842572, "uuid": "d93c362e-7b4e-4986-9445-3e82f7b45b73", "value": "T120338D73C42E7D94F149C278B9204B386B23D40696833EF4A68ADA974047EDCF6593F2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646842572, "uuid": "3793dfd8-3e73-48bb-b156-fa9c24b5c787", "value": "768:D3/zTfpYtWja5FLMJacwtASb4JHqVDoxftsrlCWFDaeN74ulXCFUo2X4CELkE2:D3/vpY6OUacwtAV6o/sJb9awlXK44CE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646842572, "uuid": "9995095e-de0a-45b4-9f65-862d3d379e44", "value": 54692, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646842572, "uuid": "a4a8b703-d660-4289-84eb-130b9867e041", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646842572, "uuid": "f431ab77-7d34-4ea1-81bf-d0cdc193eb6d", "value": "0f22fba440868e4ea7311f092afcc2e2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e9af15e-9fbc-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646839085, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646839085, "uuid": "27579ff6-612b-49a2-af3e-8103051aa49c", "comment": "Malware payload", "value": "0a72483e460ba9c63a2a761f474ecf66", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646839085, "uuid": "9be77852-9ba9-44bd-9ed6-82f46b897af6", "comment": "Malware payload", "value": "783f563d4c87eda8fbad1ad45fb1a6788498912b505686375a42936112fce70c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646839085, "uuid": "561e92a7-a72c-4c2d-91b0-6c84f81e4338", "comment": "Malware payload", "value": "fdb93d8e14d018e404873be7704ab96bb8684084", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646839085, "uuid": "a896a97a-477a-4d6c-9006-b18724c00c0b", "comment": "Malware payload", "value": "475286ad58a7b2348e0dff417ac59c14106d06416c9ddc2cefff51223dd5f1fcda4d8740037fac1842996c8adfb9f81a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646839085, "uuid": "988d3ee1-7070-4505-ab03-ff58af85319d", "value": "T117365B1AE1A320ECC63BC070876BA573F631B86911347E7F5654DB742E62F90662DF28", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646839085, "uuid": "2e30c4b2-d87b-4187-9eaf-b48cb3ccb4d9", "value": "98304:DeA+e95GdVLbMr+zf/4kViIYVidkLWDHinLtOP4eJ6FOTYv2l+98yjaGxFYFheRr:Z5eDpEOPPTdSF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646839085, "uuid": "038fe5ca-1966-45a1-ab7d-b99e7bc30118", "value": 4990004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646839085, "uuid": "5e0b5063-8e41-4606-b8c5-0297a4a09fff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646839085, "uuid": "9a89c57a-bf6d-4cb3-a6b1-e365ae363ea9", "value": "0a72483e460ba9c63a2a761f474ecf66.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e7f36fd-9fb8-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1646837448, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646837448, "uuid": "f168ee72-2876-4207-8769-80fca0760000", "comment": "Malware payload (Formbook)", "value": "6466672df1cc212c0df4ffd03168dba6", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646837448, "uuid": "c8de9523-1caf-40ab-9927-fd1275ca6752", "comment": "Malware payload (Formbook)", "value": "789d9873aa8c69588cc3cd9ec2b7e4f8db01ec340f02f370b0a56484e9f4a0cb", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646837448, "uuid": "71bb2b8d-f912-44e8-ba98-59a1b82ff898", "comment": "Malware payload (Formbook)", "value": "fc072675aac797bd1f33b0253c67dd1fbde8c2b7", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646837448, "uuid": "77b300d9-1a98-4664-915b-59445aed77c5", "comment": "Malware payload (Formbook)", "value": "232f51e6dd518919695410c5cbf9cd591886c5796495f22498c2d7b96fa4f9dbf57baa882b1d55cb2a93cd7332419f19", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646837448, "uuid": "8684cef7-4b80-4d62-b4fb-18beca100bb9", "value": "T1E80401EFF3A76541EA581DFD436FC41C0260EC46A9BAE24E560E7A043E36284C1F7667", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646837448, "uuid": "1dd24b86-d7e5-43a5-a09c-1c8857e58aef", "value": "3072:SgMOARkvyqHpzEs3z5MVDEJ4strTeeSLfsLHY+x5cFc4Ja1fKhbHEM9:DzTHpzEs3z5MGq4TD0sL4+0W4Ja1ojE0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646837448, "uuid": "aec1a1c3-2bb6-45f9-96f7-da3ab533cc67", "value": 190232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646837448, "uuid": "4a6dcc63-1b03-4cc7-937b-30df31577e67", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646837448, "uuid": "1d1efc15-af40-41d9-a412-c8129b423a74", "value": "09.03.2022.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7aa9875-9fe3-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646856119, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646856119, "uuid": "283b4cdb-5ccf-4036-bff1-4e5d52ed851e", "comment": "Malware payload", "value": "6339c653d06bf38b580c892c876b19b0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646856119, "uuid": "9130b36f-4a5d-48fe-a0f7-f1c26d89f592", "comment": "Malware payload", "value": "78cf79c5cc5ffb37dfae1c6b177281c793767c6bdcbb8062ccedd0547c89b8e2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646856119, "uuid": "d79e533c-28f1-4d26-9c18-ddeea55a91f7", "comment": "Malware payload", "value": "140605ab61b871a610b40e8ff36a4f96f996c76a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646856119, "uuid": "a08947b6-5559-41a7-8770-0ad339f5ca1d", "comment": "Malware payload", "value": "d3d748198fd4d30263de378990aefbfa768d76d6c2902e186486512063ec3efa3874e16cead8e4059a6a54b7315fd275", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646856119, "uuid": "8862e1e6-92db-43eb-aae5-9e10d9f62af2", "value": "T13CA4BF6B37FE10BEC9D1C8F3FB47A2738B5ACDA055A9E7116533B72B206028547C6A50", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646856119, "uuid": "b2ce3f24-2a92-4e94-a460-b11ed8476afa", "value": "194568caf8727710fe783ac49b0d67b8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646856119, "uuid": "d99ead92-07a3-411a-9625-b612bcd5dd2c", "value": "12288:7HRJXBRaFr+BhaHgad2ZGvqCLP2Ynvbz:7xnR5PadUGNP2gv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646856119, "uuid": "2ae3d32e-b127-4b17-b02d-d75e476e9a58", "value": 450160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646856119, "uuid": "7fffecab-4b86-45f5-aaae-ab7a563d3f33", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646856119, "uuid": "5584efb2-3a1f-48bf-822f-8ebb762cbae5", "value": "6339c653d06bf38b580c892c876b19b0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4decb4da-9fb5-11ec-9275-42010a9c0029", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1646836158, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646836158, "uuid": "0af7740e-d722-4f19-992c-6e4ca6c1cf06", "comment": "Malware payload (AveMariaRAT)", "value": "fa38770d4c89be5f663c239df633f63a", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646836158, "uuid": "0b1c9a1b-acca-4c4b-b39b-6398573b9c14", "comment": "Malware payload (AveMariaRAT)", "value": "78fbdba84a56d39f5f2814308ff94251e736ff4ef411eb7cc5bf1caff8b866c8", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646836158, "uuid": "0eb7f01c-9b7f-438f-ad28-a8803947970a", "comment": "Malware payload (AveMariaRAT)", "value": "603ebdfbb726330e577b10f6795cda824147d0f7", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646836158, "uuid": "1c502860-7a7b-4663-960c-7b3c05972561", "comment": "Malware payload (AveMariaRAT)", "value": "140ff6fe069215ebf096059b67e87899650e3c9f63ef77143c578074b71cf32bfd2abb1ae61d0bbb9037639736ad194c", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646836158, "uuid": "6392caeb-7518-46a0-818a-e87f7cdd9032", "value": "T14745D964A3A51105E9C7E77F73A04B90C8AE3C419C6EA78F4D464AC6C62E3F479086F7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646836158, "uuid": "01082a69-e07f-446f-b98d-ad35fe63a983", "value": "e565b640556a2f3c5b5d74f39577630a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646836158, "uuid": "93382aaf-5969-4008-bedf-8fbf09580897", "value": "6144:AT00RiTwSltgxCKYPMXq9NmiQBYGhpX8x4MWy1FYCz8hJ2n3C+8Jk7UBj7AlL5ai:LD4pa7+o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646836158, "uuid": "158d3c3f-fb80-47dd-bdef-d006db1aab48", "value": 1227264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646836158, "uuid": "c503c1cf-2166-440e-a76d-4d58d2160e1c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646836158, "uuid": "ec1cc50e-fdeb-4d64-a55e-6a03ca804157", "value": "fa38770d4c89be5f663c239df633f63a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2fa8c73-9fc4-11ec-9275-42010a9c0029", "comment": "Malware payload (AsyncRAT)", "timestamp": 1646842743, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646842743, "uuid": "00dfe192-e02d-4607-9ad9-102cc6084c38", "comment": "Malware payload (AsyncRAT)", "value": "4dda42ff71638d1b7c8f2cf861803229", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646842743, "uuid": "d32344f5-b5d0-4c74-af67-733f7695c38a", "comment": "Malware payload (AsyncRAT)", "value": "7981125abb5ce0068a70d2e09f0f6f2088e5847ab8744ed04028dba6dd3b5bf0", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646842743, "uuid": "7084738c-cb47-4a37-8254-a34115299d16", "comment": "Malware payload (AsyncRAT)", "value": "b007ef281563fddf66ee37b322f9f5a11cdfae69", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646842743, "uuid": "dd1f9f6e-4ea3-4dfb-bf22-290c6e0b2ca5", "comment": "Malware payload (AsyncRAT)", "value": "85c04d32a4d853dc195ed83e88ecac8dd4967e35c687c00fb4b096251ef893820154d436b92d839c42c981e39d36ea69", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646842743, "uuid": "4cf4ace7-f5bf-4ec8-a2ad-9a88965480d2", "value": "T184433D75F2828452D4650238B05942B4B32BDFC44F036B3B6BA7BF4E2F76E039E525A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646842743, "uuid": "d77d735b-ce27-4a31-8439-bade64c9cdf8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646842743, "uuid": "ff8c674f-aa87-442f-9868-36c3873ce6ca", "value": "384:8UY0UxVdqwzelSLTuueEyuxFTmOETYLNwd9WEfdwO4UdW:8Fo1+FTmOEkNaWkwSdW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646842743, "uuid": "06f81e7d-80de-4e5c-a5bc-e14177d7b1f9", "value": 60416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646842743, "uuid": "a7c7d67b-83ed-4299-b393-0cdd77993046", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646842743, "uuid": "ad08d6c8-b616-4d44-bde2-8511c3374403", "value": "WIRE_PAYMENT_RETURNED120_VA.EXE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b83cf0e8-9fee-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646860818, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646860818, "uuid": "622a104d-88c8-430f-98dd-490faf51564c", "comment": "Malware payload", "value": "3f76642735454bd3c8a3418870359076", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646860818, "uuid": "c136fb0f-9007-4ffa-a0fa-d65659144103", "comment": "Malware payload", "value": "79c6a42d9c385f5a977c6bde782226870f52b25c14454f327fbaad30d70cb2e6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646860818, "uuid": "47c62d2f-3455-4c18-8c55-d774a88bd505", "comment": "Malware payload", "value": "9296cdbb75f2521eb8d18cbdb3902c996ba07c87", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646860818, "uuid": "f0957016-b4a0-4351-a252-fa6dca62e048", "comment": "Malware payload", "value": "28bfca6d8fce850bb903e940add62bbcb16b4544263bb7b15d3d67e91fe2a752afb2a24badb957da47851374fb4524f3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646860818, "uuid": "32e45db7-4c90-4152-ae79-dfd51b87af43", "value": "T18D65D051A550E436C2A32A357C07D3BC6E26FE102F26E5437AE53F4C8E3A69138753A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646860818, "uuid": "3c0340e9-d6c6-459f-9135-16214f050dfc", "value": "f5e2fae08fb1c8fba965c988eb10e880", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646860818, "uuid": "70553aa6-124c-40e3-8ec2-2f3252029b0c", "value": "24576:8uPmLDUMihIXCE5vpJE4VDd+9tr2XXDXGXSXVOhNwVQ2RYh0zqxXGo3EUc:8u+LIIX7XJE4VButr29OhNwVQi2R4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646860818, "uuid": "9392acc1-fd9e-4e39-9b8f-995a358ba1a6", "value": 1461617, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646860818, "uuid": "73c09164-74f9-4c21-83a2-b102098736a7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646860818, "uuid": "d562eb40-1c0b-4b9f-a974-8ff465d51e8e", "value": "install2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56e26d3b-9fb9-11ec-9275-42010a9c0029", "comment": "Malware payload (GuLoader)", "timestamp": 1646837891, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646837891, "uuid": "7107f759-5feb-4b36-b77e-b51aa0af19d4", "comment": "Malware payload (GuLoader)", "value": "71eed9e33cea25f96b70642357badcd4", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646837891, "uuid": "52d28ce9-6182-4b0e-a4c2-a4259cf896de", "comment": "Malware payload (GuLoader)", "value": "79d3e3868ba629fc7c42b8bb59ce48a684e521bc3c88233882209fd64af54e39", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646837891, "uuid": "0ed2ff91-a001-489d-8cc0-b7925978bfc8", "comment": "Malware payload (GuLoader)", "value": "d26f66858fd55d9a19d6fa7cb999872e5af54597", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646837891, "uuid": "a6041a56-2989-4b08-96d4-2c997cfe5850", "comment": "Malware payload (GuLoader)", "value": "db27db6327b671ed0f37c00b90ed56616ffdc7bc4b1db81221a49f860f60a201bcfd9a1a0188372b11f1a0a0d4e1def4", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646837891, "uuid": "10de3d2d-87ab-49a4-b60e-aa95421a8e92", "value": "T11EE4C177B4083FDC9BDCEC2BA54D2A7B91DD7234208D77467260950E1AB901CF70BA9A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646837891, "uuid": "3dbb1f33-f521-4689-b879-8fc1e258f951", "value": "3072:vgHO/EI+KdJxXFdgp2XNMPBMTFBL7J/fjNII1oR0:vgu/J+KdJxXjgpPOTFVljRi0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646837891, "uuid": "a63b2fbe-fd9e-4fff-81bd-bbe71917f146", "value": 718904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646837891, "uuid": "51e27c07-9632-4f2d-b39c-57d5be2364a4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646837891, "uuid": "d2761c4c-aae1-4584-8b36-d4ff95e69f19", "value": "shipping documents.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa3f2e2d-9f85-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1646815831, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646815831, "uuid": "7770cc46-c57e-46b3-a196-7768aab35805", "comment": "Malware payload (AgentTesla)", "value": "b0291eea292f1ef223c0830aacaf210e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646815831, "uuid": "d7872b53-48bd-4e25-8a87-2c32d041ae1b", "comment": "Malware payload (AgentTesla)", "value": "7ab04c83233c30371352e45bc07cb20ab289a97db4fb6cd98855a8ba6a9a96f0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646815831, "uuid": "5cc87b86-04a4-46fb-9454-a47ca5333b09", "comment": "Malware payload (AgentTesla)", "value": "081d34272d3b01b47459942ef615f973fbc508fd", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646815831, "uuid": "842d9285-bd15-4732-963a-92d81ae3657a", "comment": "Malware payload (AgentTesla)", "value": "4eb1d636070e1af91b5df9b906b4f186c8ee8a60434126ce714237a6fc6797b55ae2d0f137a940041973bb07d1caa123", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646815831, "uuid": "8776eecc-2e5f-40e1-9877-4312913a78c4", "value": "T15E84238891CBDC503375BC6E0F5BFBD939C89F8E5A05FE6A022DD5E0266E8597402CE4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646815831, "uuid": "a885f13a-f54c-4980-99c3-2453731a5fef", "value": "6144:qlfBEWTg+RW8NnjMXdmhtF/6WLFq8188A+BiqcDZ6psVC/oj2cKS3m34bJSN7+sm:yfBTTgXdM76WpqoViqj/ojFKFVo5iCz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646815831, "uuid": "60e15962-5a14-4734-abef-025d42039261", "value": 403580, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646815831, "uuid": "61e1d14f-0ec1-42c6-82c9-456536e08e17", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646815831, "uuid": "f8d6995a-b8ef-4748-a99c-d46a1b7f6416", "value": "ORDER.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8c16ae3-9f9d-11ec-9275-42010a9c0029", "comment": "Malware payload (ShikataGaNai)", "timestamp": 1646826003, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646826003, "uuid": "c058f387-b136-4e38-9b3f-906d8aeba818", "comment": "Malware payload (ShikataGaNai)", "value": "ab13d611d84b1a1d9ffbd21ac130a858", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ShikataGaNai", "colour": "#554481", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646826003, "uuid": "d2c25d47-c8fd-4913-b3e4-fb0f76b9fa81", "comment": "Malware payload (ShikataGaNai)", "value": "7b021b996b65f29cae4896c11d3a31874e2d5c4ce8a7a212c8bedf7dcae0f8ae", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ShikataGaNai", "colour": "#554481", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646826003, "uuid": "dc063903-69c4-4df1-94d3-dd4c8bfad61f", "comment": "Malware payload (ShikataGaNai)", "value": "336a334cd6f1263d3d36985a6a7dd15a4cf64cd9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ShikataGaNai", "colour": "#554481", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646826003, "uuid": "8a7b2a92-916a-4444-8b3a-08984ee4270f", "comment": "Malware payload (ShikataGaNai)", "value": "fd125567c7e420fd0c5a49869cedad67a636406ad8bb04903d776fb649e80e9b2e345f4ba55c501b0d428c8fadcd2f91", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ShikataGaNai", "colour": "#554481", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646826003, "uuid": "e673d668-d80b-4a91-99d2-2998c638b168", "value": "T1BDD39D86F580C825C0A112794E72E6B95634BCA93D11C29A76DCFFEFFFF1490161238A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646826003, "uuid": "3227a1ed-8f25-469c-b394-efb019b3f7d7", "value": "481f47bbb2c9c21e108d65f52b04c448", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646826003, "uuid": "cea15c98-ae64-4f1d-a2e9-d6e332baa965", "value": "1536:IcfYLvQWF/CdDYn7O/Vn0Q8Mb+KR0Nc8QsECIgM7q39:FQLoW9Cmn7Ot0ne0Nc8QsEpm9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646826003, "uuid": "0e6e0dc6-2fd0-45ee-bd69-e4656b3d4f40", "value": 139338, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646826003, "uuid": "6d10eded-bccd-46ad-a6b5-99863987e333", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646826003, "uuid": "768342aa-ce22-4006-9fb2-e52544864fbd", "value": "cs_maltest.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75c17d9c-9fbc-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1646839231, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646839231, "uuid": "31256294-a205-49b9-8c28-a43ce4f78dc9", "comment": "Malware payload (Formbook)", "value": "21f856570f2c5673eab1f1296695ac74", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646839231, "uuid": "ebb30ad9-857b-467d-ab4d-4028443085e5", "comment": "Malware payload (Formbook)", "value": "7b1e3f1a9ad87103ba269b15bd375eccf8b58e259b250e828a2471d60b49e26f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646839231, "uuid": "00eedad0-20d9-43b1-83e3-c22ded0b5aa8", "comment": "Malware payload (Formbook)", "value": "eccec357210b80e403163467ead1e708e957c2e6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646839231, "uuid": "57635494-1921-4db8-b105-4f19ca5c461c", "comment": "Malware payload (Formbook)", "value": "07510d02f22da9803d40305e919d588b5816832073560ce9c0107563fdaa45e79523244aaccf0f01ce8d74eff42d0e31", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646839231, "uuid": "3277846a-20ae-41e2-9a8f-f78958b5adf3", "value": "T1CB742319DCC08D77E9C11234256B9F2D837FF2CDA29FA8AB6F690F0898617911D217D1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646839231, "uuid": "ca66b0fc-f1ec-4775-948d-a74e9d88778d", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646839231, "uuid": "ef18d9a3-fa0b-4d72-80cf-223c23c78986", "value": "6144:rGiN9Lyk80w4QZ1JvJz+RMLPIguybhhd102Dqz1/TEP9ytHqfD:B9Wew44vvJzaYPI0T70FREP9d7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646839231, "uuid": "d9f512a6-e02b-4510-a630-2909fbfea7c4", "value": 346039, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646839231, "uuid": "249a7cad-6bd3-43d1-a1e9-fdea5e07b49a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646839231, "uuid": "bea27a2d-5581-4fd6-ba5b-8977800244f4", "value": "21f856570f2c5673eab1f1296695ac74.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40c58a1e-9fb8-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1646837425, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646837425, "uuid": "35e9cf4f-57b3-4a0f-8c7c-c9c91c992ba2", "comment": "Malware payload (Formbook)", "value": "93feeeab72617e4f5630fd79f2fdd4b6", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646837425, "uuid": "f1af3ec5-50b8-405b-b979-39223dfba811", "comment": "Malware payload (Formbook)", "value": "7d39e6ca46c053c1ad744de1ca8867217596bb17bb673785eb8827b00c5ae05b", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646837425, "uuid": "92cfcd24-f443-4bc0-97e5-b030d2557648", "comment": "Malware payload (Formbook)", "value": "5f009b5cb00f71644b4ba97beca8184cfd51f97b", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646837425, "uuid": "aba556cd-008a-4a35-9345-fa8e237feb3d", "comment": "Malware payload (Formbook)", "value": "2154bb2c408ab4c23f18ce7229ed2219c02ba662446ff072584639ee4f5f1a8baeb97281d84e0a6cef2d0712506ad8fe", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646837425, "uuid": "b6b6d136-26a6-4b22-a758-56c30b04b1ce", "value": "T1901402F8F6E01375E26B33BA64648B209B3CAC6C3917511B7C7C36692575563AC2CB81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646837425, "uuid": "3667019c-6d5c-4672-a57e-fddec518ee3a", "value": "3072:FzkBPdCm1eR0IwW2h/ehYs18A7xbVpGz2laVEe0gQFuIcQ4DSVui3EtacI8G3:uPh1w0ISe9WA7x3G6wVEe5nDSVuoEDG3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646837425, "uuid": "cc5b1d5f-3a0f-462a-83e1-2b8c5b8ae2d9", "value": 190632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646837425, "uuid": "7cc96614-17d7-4f08-9b8b-f6dd606c223a", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646837425, "uuid": "9b456e4f-84bf-43f8-8dcb-83c2ab34ba79", "value": "pagamento-transazione-di-terze-parti-completo.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ded147e-9f9b-11ec-9275-42010a9c0029", "comment": "Malware payload (Quakbot)", "timestamp": 1646825099, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646825099, "uuid": "2d596f42-fa25-4b97-8583-aa6c731517db", "comment": "Malware payload (Quakbot)", "value": "e050364b4c997a012deb3a212197def6", "object_relation": "md5", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646825099, "uuid": "8b372e97-d874-4b03-8ebb-d18797743785", "comment": "Malware payload (Quakbot)", "value": "7d41ab4d59a7b038048583853dea87a54a63bbde7934598ebcee8e8388ac1eb1", "object_relation": "sha256", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646825099, "uuid": "3179a915-35c7-4e21-ac38-617a05cba4f6", "comment": "Malware payload (Quakbot)", "value": "c67ef5a2b13589f0c1453c1dcd9a3a530bf616a9", "object_relation": "sha1", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646825099, "uuid": "f40affe4-4e7d-43ee-9a9e-2122ea861e4b", "comment": "Malware payload (Quakbot)", "value": "aeb7d8b158f1199fd54fd8faf3901716cf66f3cdb44d8527bf4edefc7601327839a754a3954a7464f02a6d4f2b0e5149", "object_relation": "sha3-384", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646825099, "uuid": "b549f171-fb93-40fe-b697-c934b8b4b69d", "value": "T1C634D092859555B6D1EEAB7023424CD1C1BF306AFC0AE816178353FB3A022F76D992FD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646825099, "uuid": "8c91cc33-12f0-4ebe-b9ad-ffb233eae5b7", "value": "3072:5V5YTPZav/2I01sV03b5R228Driy4EtLa/3WumKrDMzzwJS/wiv+jfcxmpOX3gLw:5V5Eusjr222+yXNQ3MwwdofaVE2/R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646825099, "uuid": "9df90b4c-73a9-43eb-90d8-4ea9f12c4dcf", "value": 239374, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646825099, "uuid": "cdd6e533-2319-4101-9415-b4cd27ea2a73", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646825099, "uuid": "2020412e-8052-4f57-9756-1e0d5dfba483", "value": "loisctmneailruottce.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "049dd579-9fe5-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646856651, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646856651, "uuid": "2519c4b0-89d4-49f7-87fc-6a452c13509e", "comment": "Malware payload", "value": "a4a843132f4936fb80edfe2df6d80e3e", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "ta577", "colour": "#2FEF4D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646856651, "uuid": "ed73896b-915f-4a77-81fd-dd3337c06728", "comment": "Malware payload", "value": "7d59d99b89eb7aa416994d932dc853da54c4807f3e3ad4d3b7968ed4bd2e9ada", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "ta577", "colour": "#2FEF4D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646856651, "uuid": "12528936-4027-4332-b5e0-36451f624fac", "comment": "Malware payload", "value": "cc7b1c3fee6a1307c7987451f575b19ec902fe32", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "ta577", "colour": "#2FEF4D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646856651, "uuid": "c55efaf2-8501-45a1-a307-38c5303314e3", "comment": "Malware payload", "value": "69faf61b396592b1fa9712ab9602ca3a77c081e04a6bbb1dec96ea69f8871c4d832fd9a91527e06bfed80e282e5c868d", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "ta577", "colour": "#2FEF4D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646856651, "uuid": "cef515d8-8173-4924-97ac-f4ad8b169788", "value": "T100657E23F2C1887AD4761A3C9D1B739998BA79112D28F4C77AD44E8C1F37A433666393", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646856651, "uuid": "d2bcc100-0fa6-4105-990d-9247f995e44b", "value": "cf78a88c4b0403a976a85038ec51a351", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646856651, "uuid": "b3e1e4a0-7166-436e-aa35-ceed6b797f5c", "value": "24576:zP2GXxd5hyXOZk/R8SoMbEYN54UUrW/tRJfJ1OwU2SAHl4XoWSIgX4Te:zu8jI6kcYN9R1qKKgX4T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646856651, "uuid": "b0d763d4-5314-49d2-99ff-e418262086d3", "value": 1538183, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646856651, "uuid": "24d0bb19-b0de-4753-9cf3-58fb925d9ce9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646856651, "uuid": "f93ebb18-7283-442a-891e-f24c6f20b183", "value": "du1.ocx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67fa0422-9fbb-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1646838779, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646838779, "uuid": "57d4c747-3690-4017-bc41-cf4015cc5d10", "comment": "Malware payload (Formbook)", "value": "0e8fdb70524251678e30a4dafa1722d6", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646838779, "uuid": "21b5f79f-3fe5-44f2-a64f-7d823c15098a", "comment": "Malware payload (Formbook)", "value": "7db1a54a092d2e2d7873b73e3b6886ca5ca3703946103561ecf8110686a7650c", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646838779, "uuid": "244dfa70-2804-488e-ad0f-eb1d0716f3b8", "comment": "Malware payload (Formbook)", "value": "19d475e9f682617aea31387c6036ad8daa686d85", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646838779, "uuid": "839bc6fb-1533-4b04-8301-14f485c5c841", "comment": "Malware payload (Formbook)", "value": "b3598f79f13aac04ba9ced4866ca2d0bfca61e318033c02af1ebaebf8c277244f12a72fb91bc311cd872b95ce9e25d67", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646838779, "uuid": "8a98a64a-59ff-432d-bf9b-f47d02a5be8a", "value": "T139258DE629EB405DF337ABB13FC8F8CE996AE933151A70DB10522B768423990CD61735", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646838779, "uuid": "68bbb952-ac65-495d-bf02-37b68cada49b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646838779, "uuid": "8cb653ea-6d74-49f5-9444-d010665a3a7a", "value": "12288:/9Zt3Zy3WD5kPImwk4L2cx1ke1/ROl5eSaNZXyrRPXauXzLY9O21o+JqFmI:ZD5kgFLBd8lArCLY97LJCmI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646838779, "uuid": "c5d45d1d-ca24-46ec-8a0e-30ce7ad91cc4", "value": 973824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646838779, "uuid": "46ee6281-c36b-4e89-82c3-4685e81b0e70", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646838779, "uuid": "9cebad8b-7eda-465b-b7e8-1c57e5e64d31", "value": "DHL Shipping doc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50a15ab5-9fb9-11ec-9275-42010a9c0029", "comment": "Malware payload (GuLoader)", "timestamp": 1646837881, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646837881, "uuid": "f957d09b-d207-4ca5-a8b3-436ac6c4a31f", "comment": "Malware payload (GuLoader)", "value": "c661261297493a148ffefb9b36a96643", "object_relation": "md5", "Tag": [ { "name": "DEU", "colour": "#5920A4", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646837881, "uuid": "7040a52c-3f07-47b0-bf18-25cc7ffd8040", "comment": "Malware payload (GuLoader)", "value": "7f5b2d64df0005db16f4c374c7516ce15b45dc7434c88fbe7d35751306d12763", "object_relation": "sha256", "Tag": [ { "name": "DEU", "colour": "#5920A4", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646837881, "uuid": "ab285011-bdaf-4a21-8e83-d5903484cfd6", "comment": "Malware payload (GuLoader)", "value": "531c63eb34444a9861a2c05b5a30576e2b5439ea", "object_relation": "sha1", "Tag": [ { "name": "DEU", "colour": "#5920A4", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646837881, "uuid": "95f62325-c702-4936-adfd-b9c87370df0c", "comment": "Malware payload (GuLoader)", "value": "980f934cd26d2246982036b32dcb564529da0b5a5f7e0ab2a9fb584899ad5e99c620553b9e464681e96b22fdb2438da0", "object_relation": "sha3-384", "Tag": [ { "name": "DEU", "colour": "#5920A4", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646837881, "uuid": "c7326d3f-15dd-4d18-9af6-e0eeb484a467", "value": "T12C33282E871CD9D04E1667F5808E490BFAA447746213EE1FCBEF08EE54172AC9B25C4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646837881, "uuid": "96cbd474-5453-49b0-82ca-286fde1a29df", "value": "768:s8Ip1n0sa9Mdc+nUbiiGbWGIQas2bvL5RBZQmlVGssPBWgeDHn3CgnbQ1eR:0p1yMdnUGCCObVDGmLnsPB2DH3C4sAR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646837881, "uuid": "746a5a11-0946-41ee-91ca-36c28495ccca", "value": 52957, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646837881, "uuid": "311940c9-dcf1-4019-b5b6-7e971d802a06", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646837881, "uuid": "dd9bb748-57be-4b83-a212-d340667a66b4", "value": "\u00fcberweisungsnachweis.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1e186fc-9f49-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1646790021, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646790021, "uuid": "0605e3bd-bf90-40a5-9b28-b2855c81cc86", "comment": "Malware payload (Formbook)", "value": "489c44e9eceeb93b3b10d735d3e47a47", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646790021, "uuid": "ca7ce025-6691-4264-b8a8-b4270d6f599c", "comment": "Malware payload (Formbook)", "value": "8065a613ba2ec14ed040b4440ffb21b767b3aedfcfb21ef283ae29a2479f76f8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646790021, "uuid": "0198638c-117f-4ee0-8263-a13170f70cf3", "comment": "Malware payload (Formbook)", "value": "574445cb25e382a2a480c83bdbfe8109b9b2add7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646790021, "uuid": "1d45ee09-281e-45b1-86ec-0e2d73be636e", "comment": "Malware payload (Formbook)", "value": "45ee5b6ea4419b7c05b1f27eb629cacdb12bc82288e99a81f8a43a67e187228caf2dac5ace47973e94cca9e642db2dcf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646790021, "uuid": "7bbc7c23-f77d-4a7f-af8d-b1917bf471af", "value": "T19FB2D9016284772BC55F45763CB29F093226BE70B5A2AFCB24837D3AF4336E5065971E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646790021, "uuid": "c6dfa5b7-da24-47a4-93e9-6ed26175ed25", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646790021, "uuid": "e4c6d4b0-2fae-4d1a-8026-c20900314682", "value": "192:naplA+xGN8zVVESi+RJ9ih9OhOPhh/hhhhhhhehhhhhhhhhhhhhJhhhhhhhhhhhW:naplvGNCVVESimJcHqO3YV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646790021, "uuid": "6fd6fe3e-1565-4cdb-b19d-6d59c8ae4f21", "value": 25600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646790021, "uuid": "cc0a8bd5-4001-43a7-9fc0-20e5c0416c3c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646790021, "uuid": "1389d287-55c1-47ff-bbb6-dee07069e49a", "value": "po.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc4451ce-9fb5-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646836343, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646836343, "uuid": "e9b13b6d-b7a4-4839-a7b6-055caa981d83", "comment": "Malware payload", "value": "d757e865fd01226f50337226fb12e312", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646836343, "uuid": "23a7a73a-0d8c-4f6d-b15a-a2d1157cda36", "comment": "Malware payload", "value": "806a2e29a459fbc282f4fa0ddd44344e166aca2cb63f840d4d597df5d9c57fb9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646836343, "uuid": "ed6c1d3b-454a-4f6b-bed7-679982200340", "comment": "Malware payload", "value": "517619d9b51a4901a7f17b44be66af7169b79e94", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646836343, "uuid": "7ec23333-ea62-4d12-9709-95b6671ee241", "comment": "Malware payload", "value": "e67e0f94c58542f8b6421dd9637455063337b40471d6144752cad2c42ac8f097599a4b52e0f7c79a4e03e9ce1866d311", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646836343, "uuid": "9879530c-4d88-49e2-9f41-7e0e01f53f70", "value": "T133062385D9A82637E761087170D391CDEDA83DDE2824D43A4FE733DB6D7172821FA682", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646836343, "uuid": "2ecc05c7-1b36-49d3-a1dc-8ec3643950ae", "value": "38a7a81fb7a1b63fb17b662dd71c3913", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646836343, "uuid": "88ea9a6f-da8c-4358-95f5-e0e45a959458", "value": "98304:Z2JiRbxH3jmXoATIks3NeezJnGDQZ2MrKwKbNkjSXW:UJihxTmXoATIkioqJnFZ2M2vXW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646836343, "uuid": "51dc014c-d9cd-454d-840c-62e4e9f518f8", "value": 4005376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646836343, "uuid": "76a9bb91-c73b-46a4-9bdf-a682113b302a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646836343, "uuid": "b76247e6-e68b-48f0-869a-cf5a212cf3d2", "value": "d757e865fd01226f50337226fb12e312.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2b61d70-9f70-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1646806665, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646806665, "uuid": "45ea2575-4084-427d-aa94-7fb278d4c86e", "comment": "Malware payload (Loki)", "value": "8be3ee43f55f9e01cf17816d34679499", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646806665, "uuid": "fe65d4cb-cd51-465b-a610-c1526054aeeb", "comment": "Malware payload (Loki)", "value": "809c4e76bdc6751247fc1f961240c1696ed7456aa9a6902e6b0fd76345ee5a9a", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646806665, "uuid": "54799049-8576-4d58-9f03-25d529e3a355", "comment": "Malware payload (Loki)", "value": "5f9f41ea5195443fe02429855e3eff8b6a9caafe", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646806665, "uuid": "ac393e0a-7ce4-4930-837a-61858d1620b3", "comment": "Malware payload (Loki)", "value": "7f15ae8312bfb4eb8942cf268ceb41287f914a97d6c61b1a92f5e12f96d606b968e4a188b7e92b0073b81fa0f2d27d3e", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646806665, "uuid": "2612baf6-15ad-417f-94af-1291c9dad74c", "value": "T166041247A412F871C9626C7CC9269015D280BA0CD4B5C01DA564A3FFBBE92DF5F97B8C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646806665, "uuid": "8d8aaf72-ea4c-4848-bc70-0d2794383e51", "value": "3072:xTFYRDyEsfM3jQ29jH2tYiUiL4z3o5q1mTBOQvqmL7BgaQutBguM/xSVFW6h+g1Z:xTeRmoDNMRUiLqx1gB1caBI9/2x1ngMF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646806665, "uuid": "83216a4f-7422-4f73-baff-62d3c69d43c3", "value": 184366, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646806665, "uuid": "0c402a35-1b14-4a2c-9029-9d80ca648d0d", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646806665, "uuid": "c3cf5ecc-c53b-4101-af88-6b735da55dfb", "value": "Payment-slip33.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44c2e763-9fe7-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1646857618, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646857618, "uuid": "91e9ec28-3f57-49a0-9683-5371ed753d52", "comment": "Malware payload (RedLineStealer)", "value": "d93e5bcb9c1a65f86e6c397d82cc39a0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646857618, "uuid": "22b06aad-c012-4a07-a2d0-9f68f2ecdcb8", "comment": "Malware payload (RedLineStealer)", "value": "8265ae6699b82d7cd544ab6be8cf5326cae22f050038957816cbbd057a0dabd5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646857618, "uuid": "1bbcf827-be84-42f2-8ee6-80eb2da7e210", "comment": "Malware payload (RedLineStealer)", "value": "458190d3ad65fab8ad10dfca05546ae5b7885155", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646857618, "uuid": "10623a98-7742-4068-9867-2aac57038c8e", "comment": "Malware payload (RedLineStealer)", "value": "18fba134ecf7a82436517be70d0740d7fbf284516a7df84c5a0d8c1eee0b9fd0065464da54938eaa3e636ae3e1a2840a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646857618, "uuid": "4a01c38f-28a2-4411-a19e-b7f3a12a53f7", "value": "T122A34AA167CD8624E2FF4F706CB8219543F5E083A502EB8F5DC960D91F76B80E6527B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646857618, "uuid": "5467a370-887e-4278-8597-8e95712be462", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646857618, "uuid": "e8869ffe-7b90-4e2f-ba95-83874b8c79cb", "value": "3072:VucUJyaCrYi0tJkOJfy5mDh4zYnn3Wf+57YZum:VucMJRZh4UnGW7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646857618, "uuid": "075cd570-c503-47f4-92ae-1953eebb1747", "value": 105472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646857618, "uuid": "64190081-6bc2-4691-aca3-7dce89ed49d2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646857618, "uuid": "fe94a56d-fd08-455e-854d-62d316c73b9a", "value": "d93e5bcb9c1a65f86e6c397d82cc39a0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83d9d2ee-9f9d-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1646825941, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646825941, "uuid": "9efa5d50-386f-4822-9fa0-7034a21f6755", "comment": "Malware payload (AgentTesla)", "value": "3046a47587cbd744df7dc2cc649768cf", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646825941, "uuid": "f1b10220-9977-44a0-8ca4-0453877330ae", "comment": "Malware payload (AgentTesla)", "value": "82e586026c88231c5f0b058ca9ff1ff62513a3c43ce96bde58259f3b5e845a43", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646825941, "uuid": "38224e7c-6c17-4e93-9bf7-e270eee72cf6", "comment": "Malware payload (AgentTesla)", "value": "5f626d20e2a75d2a919728ee09981bc4e7925c39", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646825941, "uuid": "c41e4a81-e7e3-4b9d-88f1-fe968042e52c", "comment": "Malware payload (AgentTesla)", "value": "050bb3bb89174b000a2a6882a83ac19f357a63cda05dbdacd072420130f85972520658f29718ab060e54a15dc9fcdd68", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646825941, "uuid": "6b6c33cf-3f23-4509-93d4-a2724fd488aa", "value": "T1BA15BF10EAA6103BF17E8A791BC5E9674AEBF5721505E2BE1C1CCA490FE1A3CDC81D71", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646825941, "uuid": "e1c7a049-6379-4777-87fe-1b9adfa32173", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646825941, "uuid": "2299164c-3575-4367-b0a1-8f19362e9773", "value": "24576:YWSSf0mcMpo6XP6MlQE7TwdWTa3KbTSR:YWhFpo6qUTI53OSR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646825941, "uuid": "d5ee01c5-6e47-4c77-a889-f5de43add0ea", "value": 876032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646825941, "uuid": "9f7da99f-3139-41b9-a7ae-9e49dda00f4f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646825941, "uuid": "676fb4a8-ffb5-4f37-a157-bcbd1aefca9a", "value": "IATF 16949 LOC&ISO 9001 & ISO 14001 signed contrct.pdf_1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a0ca90a-9fc0-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1646840903, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646840903, "uuid": "ba32a931-e7d5-471f-a3b4-5b58d9588300", "comment": "Malware payload (Formbook)", "value": "6e91bd726182f17050cd97eca4af3001", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646840903, "uuid": "2f98183a-d3c0-494c-b205-dcba20529339", "comment": "Malware payload (Formbook)", "value": "83154f2c1a61337476cf237138d5f155787774c8450ff1522a97f802fc46847b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646840903, "uuid": "5a234364-6673-437e-b341-77233a31aff1", "comment": "Malware payload (Formbook)", "value": "eda19082f39fe864de98c363e7cfde863e052f39", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646840903, "uuid": "6d252409-33ac-4368-8637-5f45b0ee25c2", "comment": "Malware payload (Formbook)", "value": "f72c8afef891df43018265da356f333f7bd77bb5323e123f255f0c4f07d5fa32c24a859c973de5af562d459a4d4acea9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646840903, "uuid": "6a911fe2-e645-4784-b6a5-1bac2e6c2a8f", "value": "T1E13533113E4527AEDFA27BBF638CAF24BD60FC465C6338ADB014237985617286C5B446", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646840903, "uuid": "59618d61-85cc-471a-8e0d-6f3b48917d24", "value": "24576:6V/9vD7Snf9bcFseZKXdDY0h8Ig5hCaen6wrW2xJ0f0K02jse6Og:2/1D7i+BZ2dtg5hCaq6ah2jse6Og", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646840903, "uuid": "7ad0d338-659b-439b-8cd7-b782f2eda6ce", "value": 1159751, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646840903, "uuid": "44c47428-e5c3-444c-8d42-ec9d3e7a2d6c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646840903, "uuid": "667b008e-0e4c-479b-bf2d-cbb9d3ca7957", "value": "TELEX.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95b5371c-9fb8-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1646837567, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646837567, "uuid": "c450dba4-8ca4-467f-bb07-bd559a13a91f", "comment": "Malware payload (Loki)", "value": "15511a1ffee28951a8a385936002e8a4", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646837567, "uuid": "67502c74-19b0-424b-8b16-2b2e6d05474e", "comment": "Malware payload (Loki)", "value": "832f4bdf32fac69e92dc32b8018624de41f447e66de8eb2ae8ae4f99506f58c5", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646837567, "uuid": "aeaad612-88f6-4356-bf5c-36ce798b6c51", "comment": "Malware payload (Loki)", "value": "d63f79b8cee8364d275795b2698da802e2aedf38", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646837567, "uuid": "a877b9a6-d134-4218-92b2-eb00951173ed", "comment": "Malware payload (Loki)", "value": "64568ec15fb481dd8a735a0397f29a96ee95a0d5f4a182088717af1cab9405977d691247b854b507c432ef17aa019e54", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646837567, "uuid": "af05a360-11a1-40b4-b5ee-06cdee2a3351", "value": "T1261402617691C8F1C90458B4294A148A8BC3CC337E13F0AB7B8DFA4F907591D6EDBE5A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646837567, "uuid": "6aeba07d-2eaf-4954-91c2-81ad2d6cc161", "value": "3072:lwKPU1Pc8b57E1DxpbKOFJ0mVtZkwV7hU7pjLA4m53Fk2XNczq2GChoQkV2NqQjn:iK81PuNmiJH9U6FkIqqBCbkV2DZg3ABH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646837567, "uuid": "0ba71e35-8058-4820-9067-14d911bb460f", "value": 191336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646837567, "uuid": "98bc33dd-e230-4946-b124-5dcf785be022", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646837567, "uuid": "ac6d7652-1751-4b78-892e-a36c01ad5c99", "value": "New PO docs.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eeeaed9c-9fbb-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646839005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646839005, "uuid": "b18b4cc9-ba0c-4846-94a4-a9577f8641b8", "comment": "Malware payload", "value": "47e9ed04cbe949f46e0ba602939ae913", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646839005, "uuid": "cdea99aa-442f-41d3-b350-cf6d8ec8a862", "comment": "Malware payload", "value": "83fba7250babf63e8730b96c4ac1171df295c19aa66acee77850cd1e6ffbb0d8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646839005, "uuid": "26fcfd72-d406-4b88-9959-19040d544058", "comment": "Malware payload", "value": "9204abe2cd01c539331c53f5511a0605a943f73f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646839005, "uuid": "5095a103-0e2c-434d-b538-52dd18d97ebd", "comment": "Malware payload", "value": "8bbd7d541a2cbc8a03fc049c0b1096241672e4160f9bf85ab9571a0468c53698a1545b047f2c56d37b41b620274c9a05", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646839005, "uuid": "d0729f49-1b6a-4f04-8b60-4beabc0c8cb4", "value": "T1714533A4C1C1F0F5E21566FCC89568AFE271E95CC720CBBB44D83DADE35E06A91E62D0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646839005, "uuid": "353fa502-02ba-4870-a5a3-5fb38bff8601", "value": "24576:lm32QBcEpiG3W2V00idGl0gC8cETmC7lzTkp+v7m/rMq7EK9HXtqh0y1bKjy8n:lU28piw00iECfC7lHkp+yDMI34iy10Dn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646839005, "uuid": "bf152298-536c-458e-a7b1-bd78d7fdc02b", "value": 1277635, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646839005, "uuid": "8673c6f1-7719-4e31-a6d7-4bf1d84a04b4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646839005, "uuid": "498d26d1-96be-4af8-a63b-1c4ea863497f", "value": "47e9ed04cbe949f46e0ba602939ae913.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0cd4108-9fb7-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646837290, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646837290, "uuid": "9d79e99a-ce1e-4873-9649-eac4f6fa4701", "comment": "Malware payload", "value": "ea3ae5b3d05b0cf2329f2a499128a994", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646837290, "uuid": "3a72df31-052f-4bcb-98cc-091146d35ba5", "comment": "Malware payload", "value": "84e7d9b0cdd17672a0e306a9327ec07d92037cf8d1ba0cc2731f38a7d607f1dd", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646837290, "uuid": "41e94142-fba8-49a6-9039-26473afc69b6", "comment": "Malware payload", "value": "269b214b55822a313f702b65e83c3616fc6a6030", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646837290, "uuid": "153eca57-f316-4993-b2fa-8e8d15cfb2cc", "comment": "Malware payload", "value": "c65888de7c29900d84997900d28afa0b941503c79976f657f4c8c7c9ca30f359a5be85536e1a8b068828c470e189ab9d", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646837290, "uuid": "fdd92dec-8ebf-4028-8488-e30bee2cd41d", "value": "T12584BF7C339DDFA1C6AC847F849A292F7336A1691B41F7AB0D04B4B85D42712B48367E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646837290, "uuid": "54e05614-19fa-4894-84e5-e454ea0fd221", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646837290, "uuid": "d718f950-e793-4748-82c8-79bfefb12f7e", "value": "6144:mkeRZwZinOsdcpuq+AguGUO8x5/ywl2D536F6YDXL8Z08p7a8CzrtvwpuA7Ubs4:mkeRZwZgOZpuzZUpnyCBDXE0s+XA7J4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646837290, "uuid": "68380bfe-6e42-4bf5-a20e-a42c9551ed28", "value": 395264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646837290, "uuid": "8751977a-75c7-4a94-92ea-42412fcee879", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646837290, "uuid": "9c101ea8-b520-468a-97be-faca5e87fe47", "value": "Fvrfhre1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a314ef4-9fb8-11ec-9275-42010a9c0029", "comment": "Malware payload (STRRAT)", "timestamp": 1646837333, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646837333, "uuid": "a3f6b7db-cbbd-40c4-9ffa-7b95cf5441b3", "comment": "Malware payload (STRRAT)", "value": "8730c27a9e4872ebf0d5bd988521519e", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646837333, "uuid": "99cd6a70-2296-4907-9fc6-886cbd4fe7fc", "comment": "Malware payload (STRRAT)", "value": "853f6a2ef7ad56dd6db4d78006004e2bb9baf2773f7c9c56976132b78901e661", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646837333, "uuid": "05d429b5-4b03-448a-9957-8d2410d26d37", "comment": "Malware payload (STRRAT)", "value": "3e16a97e137b79481e2b86f7b3603d9c15155f6e", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646837333, "uuid": "651d2c18-899d-4afd-bcc6-b3e1e7284e9a", "comment": "Malware payload (STRRAT)", "value": "ba035e61af4edcbab0d6cb2dbb80cdcafe283aed7a4112d3acf24b9fabb41c881531f032d850dc62f98f144db299be1c", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646837333, "uuid": "8f080f6f-6f07-4dbe-8897-dde7d6e1ac5a", "value": "T12C04132DD6A262FBD04B0B64E2915C2D0F1CC78F1DFA99F5292A3F186D59C13600E6B6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646837333, "uuid": "076c9950-8d81-4587-8667-8441820a9310", "value": "3072:Iyu3zaJFJ+6mfAEskRAPDvkRW1nV1ncG6ajgRshlkDxxdezQL:Iyamv+3fPskR2jkcV1cG6akOlkDxxF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646837333, "uuid": "de0fbea2-f87e-49a1-a195-ec447e363c60", "value": 184749, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646837333, "uuid": "389bdd3f-2ec1-426f-b66c-b379476b101c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646837333, "uuid": "c412ca99-40e2-4483-a655-579022f15dd9", "value": "SHIPPING ADVICE#COSCOUSA.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48246398-9fbf-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1646840443, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646840443, "uuid": "7c08786f-7b00-4a8f-809d-f7a8518b7506", "comment": "Malware payload (Mirai)", "value": "f938009c20e80639817981ed68d27124", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646840443, "uuid": "eec1d692-7135-4b8f-b133-124338bc93b5", "comment": "Malware payload (Mirai)", "value": "85a401925e85652c6ec641a4f84639cba3f9959af25b6df08a19078f0a46fdae", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646840443, "uuid": "b3a48434-2445-40c7-a72a-b026053d2d88", "comment": "Malware payload (Mirai)", "value": "b24a79d89c3bff8a2645b1d2929f7f1a9d15ea2e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646840443, "uuid": "b65fdaa2-e918-495b-9c3f-380d258368f1", "comment": "Malware payload (Mirai)", "value": "bbb0a51b92b4c95460570ee4edb5be4e976c9ca34394a7926b665e797e3bad7b04174a8f2fdb4ed5ab085072fa8447ee", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646840443, "uuid": "ec56b0f3-4e32-4405-ae39-a8325334dc4a", "value": "T195233A41365C0E47C1A65BF4293F27E083FEE9A020F4F588260F9B868275E77518AEDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646840443, "uuid": "56208c63-3ad9-47fd-be7f-b6613fbe6885", "value": "768:hUXIvf3MoLmX7TL7xEzPe4DVXRo8wVOENPsV+L+S+iBCBqO0ZGIttABU0sJW7EER:Vf8oLLS4DFqOENPsVM7+0QMqvsk7x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646840443, "uuid": "b6e7823e-a006-4a49-bd66-f6f68d1df046", "value": 50092, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646840443, "uuid": "b45abcc0-041d-40a6-9af7-d490b568f350", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646840443, "uuid": "1baa5f38-81f9-43f2-9c25-d928fb93578c", "value": "f938009c20e80639817981ed68d27124", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26d34768-9f93-11ec-9275-42010a9c0029", "comment": "Malware payload (AsyncRAT)", "timestamp": 1646821490, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646821490, "uuid": "a0ef875b-9c4d-470f-98b0-dd396ce5a7ba", "comment": "Malware payload (AsyncRAT)", "value": "21acd7dae3c391311a718c9a580ad3eb", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646821490, "uuid": "a056004b-953e-4a3d-ad6d-f5e7749b69fc", "comment": "Malware payload (AsyncRAT)", "value": "85f42b5dccf9662ca791e677eeb75fbd1796e6a8a2dfa9f3dec3e951fb52ce8a", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646821490, "uuid": "32ee8213-0d55-4132-bd6b-c476e383d158", "comment": "Malware payload (AsyncRAT)", "value": "819958ed5e0745746f64404597ee253f1324a363", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646821490, "uuid": "3b9b47ef-e522-4bba-9bb8-e24fa970b5dc", "comment": "Malware payload (AsyncRAT)", "value": "8f5edd76dfbc690217df1c26e758f3b06f2e532a4cb189e67e841de671fc19f19307c1c5e81a86d1f9831a2fd42f3f32", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646821490, "uuid": "c895cde1-294c-4598-8c87-0fde02d6f9ac", "value": "T161159DE229EF401DF337ABB16FC8F8CE996AE673151A30D711521B768523A80CD61736", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646821490, "uuid": "b53e31c9-efae-4353-a601-bce9cef5b879", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646821490, "uuid": "1de891b9-5bcf-482f-b206-4704f21627f0", "value": "12288:CZt3Zy3WD5kPio7HX9EcMhiFaRvIW/hAAX7xe7vfSVoY2KdmJNlkiDrFKKhaDRp1:cD5kaMEfhemZhAc7xerfSaYeR4Kh2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646821490, "uuid": "799dbaeb-8896-467b-939a-7870d338d55b", "value": 932352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646821490, "uuid": "0cc0a49b-64c6-40c9-ae55-2c2f1642f125", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646821490, "uuid": "287ab4aa-4f69-452b-bbcc-94514702fb26", "value": "771.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cae9f5e1-9fb5-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1646836368, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646836368, "uuid": "27dc8d67-c98d-4791-abfe-725cd9581b7b", "comment": "Malware payload (RedLineStealer)", "value": "3650f23028d5ba89dab53eb058b7a0e4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646836368, "uuid": "c694c94b-3d49-4f83-8b8f-0a51dedda0fb", "comment": "Malware payload (RedLineStealer)", "value": "8692efc395794d3d986fc7d930bd0bf95444453da65dbadaf2a58ab4b0c2014a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646836368, "uuid": "6237c298-5af0-4c95-850a-ba560d5df6ee", "comment": "Malware payload (RedLineStealer)", "value": "ba69afacbc02906c36324096d9b462f290f651fa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646836368, "uuid": "bdbf4c39-4523-4207-8437-62a4b9e752bf", "comment": "Malware payload (RedLineStealer)", "value": "830e738ea15ea7c9fe78c77882b2165c6537320c7d0a0971ff36170b61152bbf8e3afae228b62dafb727b24f181bd2c6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646836368, "uuid": "7f97d981-9992-4b73-91ec-3c4ac82d0053", "value": "T1A8644B2439FA5019F1B3EFA68BE4B99ADAAFB7733B07941D105103870B13A41DED153A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646836368, "uuid": "d8e139d9-90bb-4143-b7a4-0adc78347b0b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646836368, "uuid": "9eedbd9f-019c-4816-a84a-0e9b284315ee", "value": "6144:TxsS5ZNQF3Z9Zqqz5NxSeDhrOpYgeFZshFB4Ijhbdlfp2DZChXWS2o:iS5Z+FpzvPxdD0mgMZshj3FZlfp4ZCM0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646836368, "uuid": "ae709f79-7a82-45e2-9a70-a20c81c0d694", "value": 312832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646836368, "uuid": "e6b3a8bb-c62e-4c90-90a1-80aa3ecb5451", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646836368, "uuid": "704d5aaa-7e62-4051-9334-66207934ce58", "value": "3650f23028d5ba89dab53eb058b7a0e4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06a7e697-9ff3-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646862667, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646862667, "uuid": "09588927-0b54-4cf1-a3bf-83057c91f379", "comment": "Malware payload", "value": "4d62100aee4539d77e5ea11063870ea1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646862667, "uuid": "b28044dc-c7ad-4d5f-b0e1-49623df9d704", "comment": "Malware payload", "value": "86dfcaef7029b83ff51b88cb8886bdfd16e12f61d85b8205ea4b4978f7f37c95", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646862667, "uuid": "85e1c385-2aae-4c9a-8520-4f831c8f15fa", "comment": "Malware payload", "value": "e242bf3a0172cf9f2ac1ef038c6ee8ebe5669486", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646862667, "uuid": "134abc66-b56c-4bc3-960f-f5ad98a56093", "comment": "Malware payload", "value": "2124f8ed3e80f7d4df3efbee6f6b498e10fa3e227ba4badc49e2c2599356211f50fb12105becb9128438d25a52ba068e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646862667, "uuid": "28cf6e1a-f95f-4076-ad1f-2a104e37e60d", "value": "T17BC37D01B5C29472F672097524F8DB61C9BEFC210B649DBB7384466E1F706C07A36EAB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646862667, "uuid": "050ff44f-27cf-40fc-bd26-1a863daaf7e2", "value": "ac71866b97258918d1907fe8a2afe086", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646862667, "uuid": "e2c6d85a-3efb-472f-a53c-fa9b13f491ef", "value": "3072:6lnRHWtmlwxMvuvSo7FgjnnkB6QkN8xcudwBH5OfBBqWCVh9n//35:6ExMvSmnrN6UB9n//J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646862667, "uuid": "c4df3d5b-9ab6-4e3c-b000-f5d43d75394c", "value": 121984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646862667, "uuid": "eb63ee95-c5ab-457f-9698-6ce93ffd3d1a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646862667, "uuid": "9811524c-0a9e-4301-b334-d1bb80064ea1", "value": "SecuriteInfo.com.Trojan.MulDrop19.40933.32708.7746", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a94d508-9f53-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646794116, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646794116, "uuid": "01e5697a-c64b-4f35-be8b-dd7f826f1b50", "comment": "Malware payload", "value": "589f638f255eb53c15376844e55c55f5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646794116, "uuid": "4a1537ef-0bc8-4548-9db4-b2e7dcb47da9", "comment": "Malware payload", "value": "871cae056a7d4d4263924eaa02fdd84d1101d869a90943fa9855eef1fc2b9bf3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646794116, "uuid": "68a91d6b-fb92-4568-a070-d8db6283e159", "comment": "Malware payload", "value": "6d09be2de000abc6af01eaa166b246d9a539aea3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646794116, "uuid": "cea83157-1f70-4b42-a049-f8b88ca0cb1e", "comment": "Malware payload", "value": "14f235e06f1ab5a50fae08999bcd17e1eb4a111300a55a0ed04bb9620a31fa393f183fe70fa1ea50e05bdcdbaa220ef9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646794116, "uuid": "48d0d76b-4c3b-4e54-90eb-d4c61d6a58a9", "value": "T12C65022CFB982F0EF6F94E7DD0FAD90CD3A13E9515204CDAB0A5A44B462D6427DA341B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646794116, "uuid": "6eca2401-8b7e-4c5b-b580-8332905eb90f", "value": "eaead7018736f807225bdf0cc543e622", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646794116, "uuid": "21dcf7c4-bb7d-4be7-96ad-f5aaeaebb23a", "value": "24576:bPPT9/ycfxum13bkR5wja3ZWYzjBHhj7zcM0Hc1nNXe9V:bD3qZW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646794116, "uuid": "a00bab27-c2ff-4461-88f4-b6eb5c1ed748", "value": 1497600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646794116, "uuid": "e8cae84a-36b9-4022-802d-e90c464cfaa3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646794116, "uuid": "32b432fa-7b91-47f4-8f8e-b0a505fd21bf", "value": "589f638f255eb53c15376844e55c55f5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18179ec3-9f7d-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1646812016, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646812016, "uuid": "6c837816-d97b-4139-9c1a-8aeba09fe115", "comment": "Malware payload (AgentTesla)", "value": "db69d46fff870de70a99705b6d946909", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646812016, "uuid": "f912d9eb-05b6-449a-a297-fa46b6fb5759", "comment": "Malware payload (AgentTesla)", "value": "8747f4b5136089ff859ca521c065668b82d5cb663c841b375149228615fa1dc9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646812016, "uuid": "05d68f21-e028-45c1-80d6-106fdf8713fe", "comment": "Malware payload (AgentTesla)", "value": "b98b4f59c00fe3833771fe10e47890484128cad0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646812016, "uuid": "206e28ec-8d28-4db1-bdaf-945828158df5", "comment": "Malware payload (AgentTesla)", "value": "363bd78c8ad629d5cde49da48a6b736070daaf2ebbdecf3624a19de3c4ef934307b7a3ca1f62174af7107fd3c0e38348", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646812016, "uuid": "f7423251-4b44-4fe9-876b-c1474c7429e0", "value": "T183F423F704B75BEA2095671F428B4F5CE46A91FCB48552003F54DB0BA2229E9F1B90FE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646812016, "uuid": "df7177c9-8a12-4259-b11e-d106f88542f3", "value": "12288:SFDNDgKhPx6igAsnySqzCKfLxIE+/+juNfyOK62IEYt4+XkvKogbNMf:QLhPcnfnyjz+Vs8J0C/Zu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646812016, "uuid": "30058fcf-84d2-4184-8712-d873b3b9b316", "value": 727140, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646812016, "uuid": "d51855fa-a1d1-4ade-9f00-eacc74b854b5", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646812016, "uuid": "fbeee552-3331-426e-9fe7-9b83ed3fd974", "value": "revise price.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19d0fe2f-9f8b-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1646818032, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646818032, "uuid": "34c72ab1-f03a-4cfb-abc3-2f5bd0197231", "comment": "Malware payload (AgentTesla)", "value": "4238441420acfab44e5e4481cbec62ae", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646818032, "uuid": "46cb6f66-c795-40ca-a6b6-9f696f510cd2", "comment": "Malware payload (AgentTesla)", "value": "886bcce9e180f6a1a0d1319f1a38dfc175959442cc0517f6ecb379ab3b014557", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646818032, "uuid": "3dfe3f14-4e71-42eb-8c26-eff003718b56", "comment": "Malware payload (AgentTesla)", "value": "3805803752448a34b6699458f71336671d873237", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646818032, "uuid": "c4ff2e30-36e7-4261-8650-fcf112ceaa0c", "comment": "Malware payload (AgentTesla)", "value": "84cc5fc7e66a69f52027484563412ebbd625795395057c67ac7fb1f56769b24a866687fffaa21bb6ea2ca194f90ea555", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646818032, "uuid": "77e54d20-a254-4963-b629-368900ef02a0", "value": "T16F6423E03078864ABA821EED5EA7681BCA6E70773FD9323C74C599FAC55245DE370324", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646818032, "uuid": "162fba00-b4ce-428e-9cf0-bd828ec91722", "value": "6144:R2kCrahrRLtcfTUOpcQsAAMFr7phjrASi6r0jd7vyl4pGBYJQ78enmjzcS+dT:R0sIQFMFhhjrAL6r0xnjJMnmz3K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646818032, "uuid": "fc99851c-481f-445c-b682-8007d37d2e33", "value": 313786, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646818032, "uuid": "f7fb0297-b6c2-48e4-adf3-efaf195f1a72", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646818032, "uuid": "3d37ee00-9775-47e7-9b77-3dd318133d3b", "value": "PROFORMA INVOICE.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e60511e7-9fa2-11ec-9275-42010a9c0029", "comment": "Malware payload (Arechclient2)", "timestamp": 1646828253, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646828253, "uuid": "c966cdf8-8bb2-4a4b-9fd0-5c31d3d7955b", "comment": "Malware payload (Arechclient2)", "value": "1cb8e38d70f0471cb72cb9383babaeca", "object_relation": "md5", "Tag": [ { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646828253, "uuid": "2b23eac5-4373-4f16-9c21-4a400d0c7301", "comment": "Malware payload (Arechclient2)", "value": "886c30550a351ba7d5abe9f3f1fc36ba8e5811132fc041dc79db813c86964877", "object_relation": "sha256", "Tag": [ { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646828253, "uuid": "9e7531f1-da52-4e76-90af-e3fac0eb08b2", "comment": "Malware payload (Arechclient2)", "value": "9b9e5d6cedb0dae751f52e02aee367d836b2bac8", "object_relation": "sha1", "Tag": [ { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646828253, "uuid": "cc14a8aa-d586-4a35-bda6-b1a1baff4f39", "comment": "Malware payload (Arechclient2)", "value": "c6bae97a75af4b983a98eef0e6e2d8b77a2996e39540cedfe26b397c3b6580417cdf30db81edb4a4cbcf326fa5938efe", "object_relation": "sha3-384", "Tag": [ { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646828253, "uuid": "b51aa242-44cd-40a9-8b3a-dbdb35fae8e1", "value": "T1AFC38106220FB770CDD64B799BB2F69406E36D47FB739A3A3018FB1835BA76288510D5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646828253, "uuid": "db36f1ff-d4b0-49d8-884a-8a5eea55b8a3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646828253, "uuid": "370a4d79-165a-4166-846f-e47f677f1880", "value": "1536:J+Bq+C+udFbp74dSqZ3ON5SPfvTtiE3hV:J+Bq+CPb14jq5ovTd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646828253, "uuid": "7beff48a-79a4-4da3-8d4f-e9e94b9e904e", "value": 119352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646828253, "uuid": "c40a4826-ce80-44b0-b16a-35cfddf6b4d3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646828253, "uuid": "9a5a0670-bdc8-4917-80d2-20e97d072854", "value": "test02.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fcd36448-9f52-11ec-9275-42010a9c0029", "comment": "Malware payload (RemcosRAT)", "timestamp": 1646793931, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646793931, "uuid": "233511b8-5509-48ee-aa5a-91dbdec96216", "comment": "Malware payload (RemcosRAT)", "value": "452698a7d37c840f7b651d816e29b12b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646793931, "uuid": "331f0ef9-38b6-4a14-8ae5-9f2513ccd443", "comment": "Malware payload (RemcosRAT)", "value": "88a52cb96bc7ae6d6788e1c3f4bca7c4bd379037cba08c6a86f28694f767d9d9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646793931, "uuid": "d4186a7d-ba07-4521-9f69-155de2bd59ac", "comment": "Malware payload (RemcosRAT)", "value": "26cda697f985f7a8417fa2410e2b21b9edc37190", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646793931, "uuid": "6438d397-4633-47b5-b9bb-bcf08ed7d3c7", "comment": "Malware payload (RemcosRAT)", "value": "b54638f6da7d217b5fdabedc9c00bb5b5df43d81031f646fec6508cbbb6ed8c5a2a6f2eefa6c48a19307f5e8d48756e4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646793931, "uuid": "6ecac4e1-3c5c-491c-a5bb-17140a6b7daf", "value": "T12F559EE229EA481DE336BB732F98F88E545AEE23351E219B1D713B764533D808D61731", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646793931, "uuid": "2eb336fe-eb3c-43c8-9104-15ddd849fa15", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646793931, "uuid": "92980e49-9f50-4f99-8548-93f6135b0cf4", "value": "24576:6D5kVSsc1XpuGZAU3E2kNjyUxRNfdih6hIVJ+kF:6D5k0sc1EC3iokRfHIHrF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646793931, "uuid": "ee1b9a94-6f60-48ce-acea-1cb7cfc9d70a", "value": 1320448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646793931, "uuid": "48b473de-f499-4fa6-ba74-ebcf88aaabc2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646793931, "uuid": "7b7b6551-7711-446e-b666-987799d308ca", "value": "March order list xls.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c055bee-9fcf-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1646847215, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646847215, "uuid": "5427d297-f16b-41a4-b3ea-fd02b8681d5d", "comment": "Malware payload (Loki)", "value": "d46eaefb68763eee1803f141a96928af", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646847215, "uuid": "b399c290-4bed-4935-aac9-670beb00d789", "comment": "Malware payload (Loki)", "value": "88ec25acb3f3b5a304531963e2363272c5f57bdcf44d0d423744bc8e99a52552", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646847215, "uuid": "71b1fbff-220d-4db3-a798-37268b8a4191", "comment": "Malware payload (Loki)", "value": "ea39f512d6631bea3edf49ed416ba0036f236537", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646847215, "uuid": "ff3a0aa9-3a3c-4850-ab8e-55d34a45f5b2", "comment": "Malware payload (Loki)", "value": "077544a2df7630af6bb70a8e040fd0bbb251e3f1cd19158b5ea9d7f2db42ce81e2e5fd002d55c1b5f1e74b94c08aff2e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646847215, "uuid": "5aa194e4-f7f2-473c-aaf3-7f21221ac3d7", "value": "T1D115CF10DDAA103BF26E9AB91BC5F96349DBE6761204E1BE1C2CC6890FE193DDC81D35", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646847215, "uuid": "a53c4f8a-4a35-4e76-919a-4ae65ae83f3e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646847215, "uuid": "190271d2-2635-406d-ad7b-d6f0f669f670", "value": "12288:QvPWCuJU13P3xINwXCSZ0uZjAPBgcoSBvJiKVkJstfvJReBsjUbRYc+pLUknW7:9Cf5yWzAPBgclBiaOMfRYBsYwd2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646847215, "uuid": "26c031f4-8cf0-4ad4-b619-f282263a0aca", "value": 916480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646847215, "uuid": "b50ef8ff-9645-462c-a1f7-81114badf03a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646847215, "uuid": "63994080-bdd0-48f5-871f-13278d34aa7d", "value": "Cotizaci\u00f3n.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8dd9a5d6-9fee-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646860747, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646860747, "uuid": "e17e1482-e50b-4e8a-9672-a62c90416453", "comment": "Malware payload", "value": "4f287b2bd732b73a8bd1006ba529b06d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646860747, "uuid": "d5de96d5-a194-4f4d-a251-7990690f7731", "comment": "Malware payload", "value": "8a5fde29a9074e82aace3a90eb9fd9916054c868e67b2cb6ac016ae946607284", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646860747, "uuid": "da5e461e-49f6-42b9-ac87-e57fe3abdeef", "comment": "Malware payload", "value": "3a3f3f56f8d5483cdc98621ae400b8b5efb18286", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646860747, "uuid": "6b5c23d6-3e7d-45d5-a6ad-a3a472ea0b22", "comment": "Malware payload", "value": "05bd620cf511e8af08af5e856f136dd8a7306e3dc9865488e720b982c069530c09a088803a4f525470110a7b96a3f9f6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646860747, "uuid": "1b28c1b0-e9a1-42d9-8aed-be49ea061f2d", "value": "T1EC656B73F5CBA992E4160A7C9E2D4AE81A376D13DD01D84EB0AF3B4C4B313537A27652", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646860747, "uuid": "f0cff82b-0c5c-4773-b647-ab036e3d1849", "value": "f5e2fae08fb1c8fba965c988eb10e880", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646860747, "uuid": "ba3cc1a4-38cb-4cf3-aba7-72ce6f0960c8", "value": "24576:8uPmLDUMihIXCE5uEGOivIUz4iDvXq8c+A9a/3QCyaO1C:8u+LIIX7gEGOiv2iDvXRC9a/3QY7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646860747, "uuid": "5aec795e-3dd4-41d2-82c2-391791e9638a", "value": 1537246, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646860747, "uuid": "eac115c8-2565-45c7-93e1-d035f1f805a1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646860747, "uuid": "8e3384b7-023d-4469-aff8-04865e3ccc37", "value": "install1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54de6c23-9f73-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1646807823, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646807823, "uuid": "32978b13-b807-47b0-b78f-29c11d85ac60", "comment": "Malware payload (Loki)", "value": "4f5a727084c2562649b50d08157f92dc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646807823, "uuid": "dfde39f1-2111-4c5b-a9cf-063778e763d5", "comment": "Malware payload (Loki)", "value": "8a7be8a0c295dccc2582256a703483f1015f5be5ffd8161671e30f1b0d44fcb6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646807823, "uuid": "a33b17cf-47f7-40f3-9ac2-a33d209c93b6", "comment": "Malware payload (Loki)", "value": "4b738504c87498e57b46873a1104eb584e18cf7a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646807823, "uuid": "eba5cd75-7714-493a-9eec-d8ab3ba6fdde", "comment": "Malware payload (Loki)", "value": "7a931614987c08c0be89c38a6f26ffdd40375b9352d46a88d2061531ecf812a48374eec4ed3987f3653c763812761a3c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646807823, "uuid": "e10c331a-7279-4c69-b6f0-5cf4b4c0a57d", "value": "T1CBF48E423658C0D7FABE4AB3789F957129F060BDE6C5209D79DAB35500E2732069FB2C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646807823, "uuid": "85dec145-8431-451c-b249-2ea7ad4b5eb4", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646807823, "uuid": "1714c6b6-c4cb-4694-8eaf-006829dae6eb", "value": "12288:F9ar12WsFaTVEZCHdjlgKXD39Z1/J1EviJbV:F96uFapHIKTev0V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646807823, "uuid": "3494fa31-e7aa-4941-b3fe-57d0346168ce", "value": 726301, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646807823, "uuid": "2516e534-922d-49d2-94d6-7097cf6eb112", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646807823, "uuid": "f6fa33a7-8b76-4da4-8a3f-44ab3ee646a7", "value": "Purchase Inquiry_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62389262-9fc4-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1646842635, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646842635, "uuid": "27fa9712-c7d9-455e-932d-7fdf033400a1", "comment": "Malware payload (Mirai)", "value": "29f5e3f112cae5d14296c1ea185d31b4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646842635, "uuid": "ae23e671-a5af-43e6-b67f-a114c3dcddf8", "comment": "Malware payload (Mirai)", "value": "8abb4195fd082473de3b1a53466ace2df3ca80c9d3336cc011bb32683dcb5576", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646842635, "uuid": "94ba827e-276a-489d-8683-d569b7df8af1", "comment": "Malware payload (Mirai)", "value": "73d2aaaf352bad0468e4a33e009431f9ef2c9112", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646842635, "uuid": "598b272c-c784-47b6-9685-8ece07b1e1ad", "comment": "Malware payload (Mirai)", "value": "1e767e7040fa891427ad1b6ba5a9077be3396e70d4b50d800a86ca5608d7193a661dba866d213a3ff75d667f480ba233", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646842635, "uuid": "f12b412f-e4a5-47ca-9add-134ded1f806a", "value": "T1AEE2E1594DE58662C7304C33507740AFBF8319789FAA32A97CE557A05A1D6D9D0FC08F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646842635, "uuid": "afcb2f73-a41b-4f0c-bca9-5903921643c0", "value": "768:LsrcGU/LOhlnteizu6F3YJI7cvlDdYHIJHLCL3q3UirOF:gDoOhlQiz/YJ6cdDldLU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646842635, "uuid": "9462ca45-94f6-4e0a-95d8-173210ae3ca4", "value": 33136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646842635, "uuid": "5de86269-b1b5-4115-9005-856fecd6fded", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646842635, "uuid": "c25cea5b-0444-49bd-9b37-e45487a0deb8", "value": "29f5e3f112cae5d14296c1ea185d31b4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a175099-9fce-11ec-9275-42010a9c0029", "comment": "Malware payload (Quakbot)", "timestamp": 1646846916, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646846916, "uuid": "e626d440-1097-4ed1-ae30-faa7bc5649e5", "comment": "Malware payload (Quakbot)", "value": "98d958ef2c2175b4d837298fcc41bfff", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama164", "colour": "#6C68A0", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646846916, "uuid": "27ed9416-daad-45e1-8d1b-e45ddcd9d98f", "comment": "Malware payload (Quakbot)", "value": "8b129abec1a7ece64cf97e84552285eba90ad5f37f79d4460a320f66f5de1ed7", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama164", "colour": "#6C68A0", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646846916, "uuid": "4e32b7cb-6ff8-4caf-a387-0ad8f9248bf9", "comment": "Malware payload (Quakbot)", "value": "e07d6e4d4a408ef6d98d6cdae9c91788d2939aaf", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama164", "colour": "#6C68A0", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646846916, "uuid": "b5026fc7-0c5f-4a6f-9014-9712e64b0384", "comment": "Malware payload (Quakbot)", "value": "7a02770e4baec359f45e3f131b41d3d7982d4cba493c57bed21359726f4d2064742ca864bb8537a0dd3f6ff643555b6d", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama164", "colour": "#6C68A0", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646846916, "uuid": "afd9d732-80a1-40cc-9ef3-dcb37d56604b", "value": "T1A8657E23F2C1887AD4761A3C9D1B739998BA79112D28F4C77AD44E8C1F37A433666393", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646846916, "uuid": "1dbdfaae-620f-416a-9c19-e81037b4bfcd", "value": "cf78a88c4b0403a976a85038ec51a351", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646846916, "uuid": "340fe0b1-9867-499e-a3d8-a47f47c5aafe", "value": "24576:LP2GXxd5hyXOZk/R8SoMbEYN54UUrW/tRJfJ9OIU2SAHl4XoWSIgX4T:Lu8jI6kcYN9R9iKKgX4T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646846916, "uuid": "b9da0f30-ceb1-4fc1-ad27-cb21d5dc8c20", "value": 1502720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646846916, "uuid": "e8b02eae-5d8c-42fd-aeb0-35f1c474c769", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646846916, "uuid": "6615f20f-7fd0-48f4-b61a-a34b261b6a4f", "value": "3173133.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "978a7a10-9f79-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646810512, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646810512, "uuid": "835dfd32-2b9b-48bb-9c69-8c9a5d3f1dee", "comment": "Malware payload", "value": "f7d52cd712a6cc34b2ba8833af107fd1", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "coper", "colour": "#EED7EC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646810512, "uuid": "fec28e7d-0171-4b29-8c02-727e25fe6960", "comment": "Malware payload", "value": "8b661478539c2d037c3a6cbdb595c3b55097927d2dad338c96bcafd8926e91fe", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "coper", "colour": "#EED7EC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646810512, "uuid": "270b6fd0-0340-48cd-9cf5-b645d89134ef", "comment": "Malware payload", "value": "8f37b442613dae153b57558b582b3a678220e309", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "coper", "colour": "#EED7EC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646810512, "uuid": "29d00ded-e205-46f9-b9f8-d07785883937", "comment": "Malware payload", "value": "4b646fd4869f54aa31f0aa8fc38ba45ad4081d819d8bf7d5b27051cd80dbe6986055be4ce141a8dece244524c9336aff", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "coper", "colour": "#EED7EC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646810512, "uuid": "abfbcdfe-782b-4246-8529-8ce7c7051be0", "value": "T17665F186B7C1AC2FCCB7C4350F5A8325A6569D57C687D307A9943A3C6EBB7D00E48AC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646810512, "uuid": "4b58063b-a4f0-48fb-9844-23623bbd31b5", "value": "24576:e3W3BW9f5P5MRNFsUdyTIXNtnbHVJ/I0NXzw5ZrFU7SLMuBUVrMUBsycgwDpo6N:e36kPYtdyW3/dIBU7SL1mMQsycgwDH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646810512, "uuid": "8b214b9a-955e-4b18-a60b-5c418bdb8c7b", "value": 1429430, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646810512, "uuid": "6896be10-7d8b-4b63-b6ef-96a4dc3fc8b3", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646810512, "uuid": "db656712-efc4-4bea-bbee-fad4618c446a", "value": "psk.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b2574e6-9f9a-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1646824584, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646824584, "uuid": "7fb6ee9f-2678-4c20-b5cf-49c8e1abb92f", "comment": "Malware payload (AgentTesla)", "value": "5b5703da33ba342e526436deea065ede", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646824584, "uuid": "796f7abe-0a8c-4733-9554-25a47d837ed5", "comment": "Malware payload (AgentTesla)", "value": "8b8fde19e5c948970e3b88fea5e3eff3f4291616c6cf95a8e51144e3df73dff0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646824584, "uuid": "6c908b2e-9dc4-4c7a-84ef-1896a0afdfda", "comment": "Malware payload (AgentTesla)", "value": "b955c2b9b3761a8a976f485cadf00cebea3dd7eb", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646824584, "uuid": "ba636f2d-6029-46af-962e-9d9cf3d764e6", "comment": "Malware payload (AgentTesla)", "value": "3ade364584db7a36d16f5bfdf715a16330f6e300f70df7e510934159f00d178b5dcef3eeb46a72f749985ea21b05e5f9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646824584, "uuid": "d16c660a-d4fa-499a-90d1-902558cfcd7e", "value": "T160259DE229EB501DF377AB712FC8F8CE986AEE73151A20DB10522B764533A40DD61736", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646824584, "uuid": "5738da98-0108-4169-9203-9157c1255ecc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646824584, "uuid": "9c836b09-3dc1-4d65-b4ab-7aa1228bfdf0", "value": "12288:hZt3Zy3WD5kPQa5i3cWUWiHgfTAvjzOhPCOKXT+HH7IJ14RLGhJo4oEVdIa8ELOm:9D5ko1F4AfTAvjzOGaz29f2eZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646824584, "uuid": "120f6ec5-db26-439f-aee2-22d5f8c3bd7a", "value": 1002496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646824584, "uuid": "96ba911e-fcf6-48e8-b257-29e79eede678", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646824584, "uuid": "ded8c09f-f96f-4d63-95f5-a3855646e6ca", "value": "d7EXlRLUZfAfAIC.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "461406ef-9fbe-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1646840010, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646840010, "uuid": "4ed6201f-99b5-4e27-8de0-50e94cae18dd", "comment": "Malware payload (Formbook)", "value": "bb5c82564ed6497edf7916308bfe0059", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646840010, "uuid": "16d1b44b-38da-4114-98b7-a00a29fc584d", "comment": "Malware payload (Formbook)", "value": "8c484128e93581f7c49745f4fe547a22fb6d8fac812741dfc122a7a2442d099a", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646840010, "uuid": "db21e914-2bab-4bd3-91e4-9fb0d14d3b6b", "comment": "Malware payload (Formbook)", "value": "81cfb6ae181c49bf4926b3f88c47a0ad19acebf0", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646840010, "uuid": "72e3e224-f7dc-4add-a610-61fe53415e59", "comment": "Malware payload (Formbook)", "value": "786c7812ae7cf13d6244987ebb4c7c8799b0d0ea60ff91317be588a42c8092d1488486a9462709656ff52d2cd90dedee", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646840010, "uuid": "0f7c156f-dd66-47a5-8bf6-096ee3c85c83", "value": "T152A423BC971F227F57C32B660AA7F42FAA69553D932146114C2BE31CC40E4F99DA93B0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646840010, "uuid": "89fca33c-2b71-40ce-9456-e7e8526c125c", "value": "12288:Yi6GU+mdyUMYH6B//h2QgvOiFPcWawCe5Iavi6UW:YDZvMYa9pjizaHW3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646840010, "uuid": "3da9de1b-1e92-4305-a086-41c7791216b1", "value": 463123, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646840010, "uuid": "3d99aaf8-66bf-438d-b29a-0d5b2606f321", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646840010, "uuid": "73307e3b-6727-480f-97c1-5d762fba1435", "value": "Swift copy.r15", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe50653b-9ff5-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646863942, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646863942, "uuid": "4cef1d54-6ba7-461f-a07d-d2168024a546", "comment": "Malware payload", "value": "906a82fb03a114f080d46b37afb1bdea", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Redline", "colour": "#71EFB8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646863942, "uuid": "17d5dec7-29af-4a5c-9b46-ed0f63b8b662", "comment": "Malware payload", "value": "8c6313399401aee972c7202d294ae0e2b344deda75728c3111d2f43825cecf95", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Redline", "colour": "#71EFB8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646863942, "uuid": "a3d7559f-074b-46ba-aa39-edf6061c39b5", "comment": "Malware payload", "value": "38836c2ece309e518fac56be4bb37f754bf0788f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Redline", "colour": "#71EFB8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646863942, "uuid": "92e67e50-c632-4174-a082-ee036bb321e8", "comment": "Malware payload", "value": "7ea495dcd0d16f11948c85a2a36b11bb78031c3f727563fe3de7c550ea8c69b9bcb62a8c231feca58f6b9dde7a39fb7c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Redline", "colour": "#71EFB8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646863942, "uuid": "09c30675-a1d9-4184-99d3-221ba3e87bb8", "value": "T1ECB41257CBC854A2C4AD86B714FA2E241D38F6D16C4E2FAB8357198CC864D67BF71309", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646863942, "uuid": "089d87f5-5531-4f43-90b0-ff4d1584b534", "value": "1d09f42a5430529bc1f09d4d8a4b4581", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646863942, "uuid": "8404c64d-82ab-47e7-824b-4fa5114dd95b", "value": "12288:y7MHdlBMIKLr6WTc3uF7qFZo6WKSIt+aEGaC124CO:yA93C7T6WKSIk62g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646863942, "uuid": "ccda49cc-6d2c-4c22-9bfa-32e1393a0239", "value": 504912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646863942, "uuid": "4e2e76a2-6d00-4f84-bcdc-6840a01e0270", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646863942, "uuid": "4452252f-675c-4ffa-b0e7-23a425b73f04", "value": "Setup (1).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b57407a9-9f80-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1646813569, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646813569, "uuid": "f2610d54-4e83-4fba-abf0-5b22a996857d", "comment": "Malware payload (AgentTesla)", "value": "541c797baec05265be66ab0e19d87941", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646813569, "uuid": "d9332d30-1171-4c30-b65e-286b214662ce", "comment": "Malware payload (AgentTesla)", "value": "8c70d1a93bf98b30185c39599f553297fb27e8d40f1cef59c4040f1cfa84fb8f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646813569, "uuid": "28891032-1e7c-4eec-b6cd-70da91b057cb", "comment": "Malware payload (AgentTesla)", "value": "5a45238b1a5958bffd6df39aa7dc0a4f4ab25f1a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646813569, "uuid": "390d8e25-1809-49b8-8ac1-931b6e8f8d2e", "comment": "Malware payload (AgentTesla)", "value": "9dbb7ff980a6ff78a791257d19ee5608f0df68ec9a405247ff707bad759c5aaa4018246a35bcef5f6fd7b25df8bc17c8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646813569, "uuid": "de5806e9-8c43-4d2e-9503-b1c51767595f", "value": "T1F4F433E2A3A84D069993BCEFA3E75E0428737510BA6BA0E7E130E206F739535DC55317", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646813569, "uuid": "afc3e749-1166-4e89-93bb-04cfeab4d63a", "value": "12288:0/R2iioNvzseXnx6of4wY9H6lIEdcn6qXVxUZ3nspNnEr3ip/C+A0shE5MyIHegJ:0/Rz1NLseXxff7YNKFwpSnsPwwCB0shr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646813569, "uuid": "756bdde6-e91b-4e6e-b860-827366301c52", "value": 768203, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646813569, "uuid": "2c8622d8-976a-467b-a2c5-39996cf8f8df", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646813569, "uuid": "e042e1f0-1d75-4c51-80ab-7da93cec7d55", "value": "4 Pallet Shipping Docs.Commercial Invoice. Packing List. Bill of LandingTHS00945872.r15", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e5f6031-9fb2-11ec-9275-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1646834924, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646834924, "uuid": "8313dbc6-dbd8-499a-855a-d9f10e08e95e", "comment": "Malware payload (SnakeKeylogger)", "value": "8df64342cbdcb3fd806603d80efa5910", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646834924, "uuid": "07002fc4-4463-4f29-8eb9-99c3bee9ecbd", "comment": "Malware payload (SnakeKeylogger)", "value": "8cd918f07e41c51c91a876659d8f375cb9c8c15bd02135d2c2b046e029ff34ad", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646834924, "uuid": "589cbe73-ae51-4eff-9cb5-1e2c134a03dc", "comment": "Malware payload (SnakeKeylogger)", "value": "0893912aeadec2ef4a1d87db0e27ebe423e5797d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646834924, "uuid": "dedb2678-cfde-4c5c-89e9-9c0f62e8601b", "comment": "Malware payload (SnakeKeylogger)", "value": "f82b0a7cbdc18afff4aaa5dedc45b6a05f4923434be70babd42049f75a0848843213a1108cea2bc990789ac66b64b84f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646834924, "uuid": "adb38f9d-048f-4102-980c-227c841f4dda", "value": "T1EB4402B267295FA3D87FCBF6102553694FB623A60502E75CDEA430C90979B8046D8FB3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646834924, "uuid": "23b5a99b-2495-4d4b-b458-01b6725c7cc1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646834924, "uuid": "e1fac6a3-21e5-4e19-a238-bff7bb800d55", "value": "6144:rWgWiGE1MYICxnVQBT35u35LJS8+xuiNF7hCZ5At:rWgWBvYPxmBc68+gi7hI5K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646834924, "uuid": "33a118c3-576a-4d2a-87f0-1d9d29ae8784", "value": 278016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646834924, "uuid": "e76eca87-f18e-4893-9d9a-985a617f2f19", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646834924, "uuid": "66b1e07a-d24a-47ae-95d7-4c0bb0734144", "value": "PO18334 (signed).PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ad76d72-9fe9-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1646858487, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646858487, "uuid": "11974a44-5a86-4208-8372-c32690ea9ddf", "comment": "Malware payload (RedLineStealer)", "value": "44018ccf06720f22479b8c7d393e0037", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646858487, "uuid": "a9866d58-0989-4272-b97d-cbc7ef6dbd50", "comment": "Malware payload (RedLineStealer)", "value": "8d24088af7e30a10b205a46136be754a6cb760479866fd9cfa8c2b15bde4c32b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646858487, "uuid": "2d8047a1-405c-4d53-ba79-26680a346902", "comment": "Malware payload (RedLineStealer)", "value": "16be7162522e793cff693c816e24ebe949fef0ce", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646858487, "uuid": "12b836b1-7fe7-463d-a4da-1d111ba40e25", "comment": "Malware payload (RedLineStealer)", "value": "b153f91453ffd4bf4a55cf47eedb96533cd6525d31a8338a4b9f4eb78968fbb1e1e162612be2f34cf089ea09786e4b24", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646858487, "uuid": "e144d542-9778-47c3-ba2f-4c971f0d7c68", "value": "T1B0A34AA067CC5664E2FE4F706CB8119447F4E043A902EB9F5ECA70DA0F76B80E6567B1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646858487, "uuid": "271e4884-3836-4165-9579-09077fe1418b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646858487, "uuid": "7d84d284-32ff-47d6-8e8b-367313391e6a", "value": "3072:DucUJy6CDYS0pRO9fyZSgBPY9pZLT6trqvA3C8:DucMpRAXd6tM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646858487, "uuid": "74fefdca-b2fb-4bd6-9e18-512c929bb297", "value": 105472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646858487, "uuid": "aa161acb-1355-43b8-be9c-2c088000a7f7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646858487, "uuid": "f2769748-3ec6-4e75-9ea2-62c25364eb7f", "value": "44018ccf06720f22479b8c7d393e0037", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d5e668a-9f9d-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646825957, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646825957, "uuid": "27dc5fea-55ae-4316-8f10-6ad5ce2e6891", "comment": "Malware payload", "value": "d6c35e58f12b5fa7685478cc25e535de", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646825957, "uuid": "fa8e2aaf-9b18-41fc-b6a2-e31d9b5929d2", "comment": "Malware payload", "value": "8d7277eda65543512fcc776c2351fd470c0cfd2333bfa96666e464a754ccff14", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646825957, "uuid": "c38cbe61-86d0-409c-a089-8802a6f65682", "comment": "Malware payload", "value": "25392350142927bd91bea1e0d37ffa983991c108", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646825957, "uuid": "aedbb571-fd1a-4c37-b3c1-b45e0a4cd091", "comment": "Malware payload", "value": "f1f769a81e80406fc2a907dd498f6c26c4c838015a4c9018288ac05dc4aa2cb04099526eeb52016f3e6e64698c018d24", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646825957, "uuid": "1e93b13c-86bc-440d-b28d-f823d1d7decc", "value": "T19531E929860E4743C60E93BC895DDF233DC6CEE4449F92C165F573690DC6630891AD42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646825957, "uuid": "57110862-e848-4c4b-bf02-72e78a17c2ae", "value": "24:92KRtR0Rab5F9lBIUJc/AQ5vTM/k6njDPlNuZnoj9/PZRF:92KRtFNFBIP/A+M84nPl8VG9/PZD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646825957, "uuid": "a9ed0db8-4360-4425-a8c3-4d72484d1a48", "value": 1467, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646825957, "uuid": "aaba9770-1e8c-4a23-af18-095a9dd8daef", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646825957, "uuid": "35ecbc8d-4856-4efa-b526-0a138aaae4b8", "value": "PO#BC220402_4.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5702e16c-a000-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646868386, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646868386, "uuid": "d0a09b8e-f6ce-4713-9413-0ac4c2239624", "comment": "Malware payload", "value": "ea0573c9b5ad79bf26f3877f30d966e0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646868386, "uuid": "88a74b8d-7654-41f2-bc82-2bd52515fab1", "comment": "Malware payload", "value": "8ddb0758d53faee14a362ad086fdf59ed5bb9dcc308f3619f0fe68cb5cf0c5d8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646868386, "uuid": "49ed65d4-7492-48ef-9a60-a2f433a8d64a", "comment": "Malware payload", "value": "b728178cf473c9ab266d97858e17ad9c3781b60f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646868386, "uuid": "214fb4f7-ed29-4c07-9cc2-2ebdd4f7a761", "comment": "Malware payload", "value": "e5246956c60d0b5fec6a9ff7449419287c75dbd87d65c91a824418245cc4b673805c79642ecfc74b8697d2f02ec9d969", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646868386, "uuid": "880b9461-a956-43db-86e2-7358aa543323", "value": "T19044C0213BA1C432C4935170AC29C7A1AA7FB5315AB5D54B37A81B3D4F703D2AA7734B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646868386, "uuid": "201aada9-4bcf-44a0-ac9e-a20a594418e0", "value": "ff8b9f66e50ce9e9d4ab740e6c8cda2a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646868386, "uuid": "9cd6eeaf-270e-4b0d-8361-a6178c68a4e9", "value": "3072:QSymA5gH7LHrJvs4i1rb2NAq7bl5hNqG:BPH7LHlvOhmlNv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646868386, "uuid": "79c87eab-79ab-4709-8b4c-41b8024cdce6", "value": 264704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646868386, "uuid": "6a9a7529-a874-4ed0-8dff-813add182694", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646868386, "uuid": "78ca67b3-e53a-4076-8523-5e9ebdaee5a2", "value": "ea0573c9b5ad79bf26f3877f30d966e0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d84fc97-9fe5-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1646856800, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646856800, "uuid": "84bf915a-bc26-4e39-bbd0-a3cb8bbdd27a", "comment": "Malware payload (RedLineStealer)", "value": "474531d62e7bc13f6b86f2e8dc6c96e8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646856800, "uuid": "08746338-cf29-498e-8380-42c0ba2a5468", "comment": "Malware payload (RedLineStealer)", "value": "8df6d0e3f95fb3f04f6316d2dbeb59ee9a20e2ff9c91953fab95b6f11b968bba", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646856800, "uuid": "41136533-22e3-4e4e-9dea-d7f5bcdb68c8", "comment": "Malware payload (RedLineStealer)", "value": "080d5cb99bb704ceddc3a480e714a7ad6e6cd646", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646856800, "uuid": "ec9578d8-4826-4282-b4bd-0a1a76801790", "comment": "Malware payload (RedLineStealer)", "value": "7ee9a065b8462c97f7c91b0e1e1c6a404828ae02667a16db50c6aabcde10b716ccabc952b0750b725874d3df02a439d8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646856800, "uuid": "927e0270-0b1e-4225-aa55-7dd5d335c445", "value": "T179C423DF5B47566DD70C48FC4880EF5680F809B20DC8BE762376D581264AAB6FF046EA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646856800, "uuid": "214efe90-1fc4-45a3-8b05-599b3db5b01d", "value": "445554923421947cbff896012e27345a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646856800, "uuid": "f9249c87-edd3-419a-a744-b8c35fbb4c1d", "value": "12288:h/AbB2j3H9wWqUpWrQS03ULaHNqrxlKIQNoTI1mcOeOvqlkrW:LX9qUpWrkEaHNYK3z1ZOeQqL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646856800, "uuid": "87037a0f-904a-4f3c-ba05-95cde8a4b9f2", "value": 593352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646856800, "uuid": "156786f0-fc86-4ff4-9ed3-4fef9ef0656c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646856800, "uuid": "4ba3c5da-f2d1-4650-bfa6-83379cc5ccee", "value": "474531d62e7bc13f6b86f2e8dc6c96e8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "134a8fc3-9fcf-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1646847227, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646847227, "uuid": "5f52ab82-bd1c-4e31-9bc2-e76b6a847e21", "comment": "Malware payload (Mirai)", "value": "d93ad2b97fc804bda932090d0f21552d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646847227, "uuid": "2fc690e3-ad31-40f3-adca-04f2b8b8ccb4", "comment": "Malware payload (Mirai)", "value": "8e1d632ba49dc9a37fc38d94888212088f1a217532b10d47236447241828bd56", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646847227, "uuid": "27bebf5a-2a3b-4a77-b674-109c6e6096d5", "comment": "Malware payload (Mirai)", "value": "6a63544d83328385503cf41d7139dbf48c6e65d8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646847227, "uuid": "b6fa5b41-d8c1-42ea-afc1-3d92f15129b1", "comment": "Malware payload (Mirai)", "value": "a4476fa371abd1e1e03703926ffcc903964979bf296daa06dfd6720601369eea0b6a5aa277fc4256382ffc9d0b2d38cb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646847227, "uuid": "51be787c-79e8-4d57-9b27-af13676a2df3", "value": "T10C531891BCD18A12CAD462B6FA2E418D332663E8D1DF3207DD216F1177CA82F0D7B556", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646847227, "uuid": "4ec53258-f8bb-4980-88ef-8268c6f31d2e", "value": "1536:hQXM2Xp+pFw6jsFaBCbNOVrL2yBCtt5KwTx9p:h6X+pF8YlvYbKwTxT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646847227, "uuid": "b3004fdb-c2cf-46b5-93e6-33356980ce95", "value": 60800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646847227, "uuid": "87cd6c8c-14c7-4667-a5fd-b7e5c204c3d5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646847227, "uuid": "ab1ceca8-ee73-4943-9ebb-544bce6824b5", "value": "d93ad2b97fc804bda932090d0f21552d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59239347-9fe5-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646856793, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646856793, "uuid": "fe269048-8918-465f-8dca-34d8318ac455", "comment": "Malware payload", "value": "08a3984568f0bdf281edf1a57e528e35", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646856793, "uuid": "322074dc-f8e6-42a2-b055-95b832f68db3", "comment": "Malware payload", "value": "8f0069e7d1874aa770fa8b8f8e59b7eb8498829039cbf00e6a87d97a5aa9c4d9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646856793, "uuid": "76b80f4b-d6e8-41dd-b10b-b566ddc4d4b6", "comment": "Malware payload", "value": "7e972cba0ac388db9a4f6e4304e3d7646501914e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646856793, "uuid": "b31cb228-73e6-4af8-ab82-56a7c8d2cc45", "comment": "Malware payload", "value": "6063b9e3181a2ad5b143fd5b5092a79ef07282ffc630b6fb1bd1d40e3b34c41afab3fc14a0a983b58929ef80a01b2e31", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646856793, "uuid": "0a408685-d3bc-45af-88fa-adefc9f4166a", "value": "T1AF452361BB159087D44269B80C9275B687D8FC03C4990F7375D2BB4BECF234ACA4B5EA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646856793, "uuid": "1651c4bd-1f22-4545-9e41-d6345ef756fd", "value": "f1bd13f7ad30b2ee8306b86276790124", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646856793, "uuid": "c4d1fdd2-1ecb-4eba-aa59-8b5df30ca708", "value": "24576:aa6BqN9Lck/nH32Ehhw6RUJthi5IaVLTVNdVAknHB+r7sHn:aN8N9jH3Xhw6RUkrd12knhc7W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646856793, "uuid": "599daed7-a888-4c43-b79c-e1b8b4f1bacb", "value": 1174112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646856793, "uuid": "96afa613-29af-423f-b347-d2d8948012e2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646856793, "uuid": "de16a040-855f-4884-8d16-29455a4a696a", "value": "08a3984568f0bdf281edf1a57e528e35", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afc770c2-9ffa-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646865958, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646865958, "uuid": "27b4f060-3560-4cfa-a96a-c3fa8d4152f8", "comment": "Malware payload", "value": "b7aedc06f9002516cdc45daabce3d0d6", "object_relation": "md5", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646865958, "uuid": "19932107-a194-460b-b286-ef2333ba44a9", "comment": "Malware payload", "value": "8f0d93b39ecd594b2bc35b48febe29a68a3d0fe2075353e48c7646b4261ddaa3", "object_relation": "sha256", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646865958, "uuid": "560b5174-583f-4f68-99e1-18b480476498", "comment": "Malware payload", "value": "f5e6b5dc16447b81e9992a6f79993bb3aecd44fe", "object_relation": "sha1", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646865958, "uuid": "6b96bbda-f460-4fed-8211-ccb03d1e40cb", "comment": "Malware payload", "value": "e00f4744d975bee154cf11e2e96b1a1ddb485724104b78c9aa273149b8ffa5f4251e9ca615c9a04b711b906f1c48c0af", "object_relation": "sha3-384", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646865958, "uuid": "48c0355e-8be2-4168-b2a5-7acbee52c27f", "value": "T12913D02CE6573105D6319CBD560CDCF56E0D30A7550ADA8B1448BACC2FC2BFB12AF198", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646865958, "uuid": "f01b4f48-3392-42bc-a6df-aa3118c1a892", "value": "768:SFVCToSyUn+qpOw+pyZfQCwBzii1H/KNsH7meB1Id5qXkm1qVw0cyjA:SFVQsUnpOw+pyZfQCezfCNRejIdcXheg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646865958, "uuid": "c50825d9-2ff1-4b4a-91ac-ab71af5e0c2d", "value": 44642, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646865958, "uuid": "096b1ee2-ae76-44f0-87d2-5e72f70f0420", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646865958, "uuid": "fc6a0ff6-de94-480b-93e5-7b3314cb17d7", "value": "Daten-0903.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e06ab21-9f86-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646816079, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646816079, "uuid": "9072d5a8-20a2-443a-8a8b-5fa96d429fc3", "comment": "Malware payload", "value": "fe43de9ab92ac5f6f7016ba105c1cb4e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RURansom", "colour": "#71CD12", "exportable": true, "hide_tag": false }, { "name": "Wiper", "colour": "#614E92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646816079, "uuid": "9aa858ab-4ce0-42d9-bbc3-ba0273d8d403", "comment": "Malware payload", "value": "8f2ea18ed82085574888a03547a020b7009e05ae0ecbf4e9e0b8fe8502059aae", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RURansom", "colour": "#71CD12", "exportable": true, "hide_tag": false }, { "name": "Wiper", "colour": "#614E92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646816079, "uuid": "cd5a23bb-985c-42f9-a86b-c9233fe8db30", "comment": "Malware payload", "value": "27a16e1367fd3e943a56d564add967ad4da879d8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RURansom", "colour": "#71CD12", "exportable": true, "hide_tag": false }, { "name": "Wiper", "colour": "#614E92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646816079, "uuid": "91dc2e59-1419-4e55-b376-7d848506ab19", "comment": "Malware payload", "value": "f5380b262f636cbb30cba1b2eceec0b3ad1b1c53b104e9ec5211512a7c4cdb0c208c28f648fd3d62ccf5b3e6969f615d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RURansom", "colour": "#71CD12", "exportable": true, "hide_tag": false }, { "name": "Wiper", "colour": "#614E92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646816079, "uuid": "135e84da-4aca-4395-8a25-0d9884442c12", "value": "T1D842F80BE6E88531D53A41362DB783928335B6475A06DBAEB48E651F3F3222553633F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646816079, "uuid": "8d54049d-6c38-4acf-ae57-ad78d3db63bc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646816079, "uuid": "7286259e-7917-4874-95d7-1265f70df8ab", "value": "192:s7URZBmBL00XNbzJdaGJEYXh693OjHjnV8stYcFwVc03KY:s7EZY0MrEJ+bjnVptYcFwVc03K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646816079, "uuid": "1b1b691d-bf47-433c-9781-2dfe5c8e21c4", "value": 12288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646816079, "uuid": "0eee86dd-e1cc-404a-839c-826082a8e629", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646816079, "uuid": "3cc346f2-d0be-482b-9dff-74794f5af6f2", "value": "8f2ea18ed82085574888a03547a020b7009e05ae0ecbf4e9e0b8fe8502059aae.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d73649c-9fc4-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1646842627, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646842627, "uuid": "d08fc2e0-3664-41a9-a189-178e006f6ddd", "comment": "Malware payload (Mirai)", "value": "f259dd19f8a8bd2a7bae4f232cfbd874", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646842627, "uuid": "d21017c9-28f2-4864-bf50-8096aaaba4aa", "comment": "Malware payload (Mirai)", "value": "8f549767ecc41d3e2cdd8f071a6b19425913f98064697877cee30c8c9f69a8d3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646842627, "uuid": "993e731d-0aa7-44bb-a91b-f1015cc70c01", "comment": "Malware payload (Mirai)", "value": "88e842629acb82af445f737c32be234a834d0a2f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646842627, "uuid": "2cce74c2-7917-4b29-85f8-f4e72a81c227", "comment": "Malware payload (Mirai)", "value": "328ed6dca4884c3f2b426387d4010da439f79a6e72f08e8b7f11c822d8057250216b02e532431df07774bf54119fb8c5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646842627, "uuid": "b5c126c5-7029-4fc3-8914-5965ed69b3df", "value": "T163D2E132405C3B75E3F235B2DC3B81039AE92B3C84E7F6A39514A5946CE7091A968D8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646842627, "uuid": "b921dd8e-a63d-439f-a473-64748da183e4", "value": "768:RWfqCHsF6at08FqjMCmRdtzjUUxPissjJq3UirEuF:kf9MJt0qHzxiszF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646842627, "uuid": "a1c774ca-e48f-4e1a-95c4-59526210c7d2", "value": 29396, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646842627, "uuid": "080494c7-2448-453a-a858-ec98f3a6126e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646842627, "uuid": "85d22836-9fc9-4466-824f-a4cc47d0e987", "value": "f259dd19f8a8bd2a7bae4f232cfbd874", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d0e5915-9fb2-11ec-9275-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1646834949, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646834949, "uuid": "3ffd6f81-690e-4fe6-a884-51894bd0886f", "comment": "Malware payload (SnakeKeylogger)", "value": "e547cfc55903be5395409f2274d8d055", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646834949, "uuid": "799bca72-e68c-4415-a974-0b3967f74865", "comment": "Malware payload (SnakeKeylogger)", "value": "8fafb97685664f52793149fa849b9593f20a95584928020d4e6fe8e4513950eb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646834949, "uuid": "08cabf89-80ca-45b9-b04d-2ce1c84d5735", "comment": "Malware payload (SnakeKeylogger)", "value": "27a1eb61980e429481ebfaee800063eda8fd051b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646834949, "uuid": "1d9e8545-0ffb-49f7-a9b3-a45f2514aa05", "comment": "Malware payload (SnakeKeylogger)", "value": "29f24c5ad1fbddd8e4f1fab05856abf610e985698a83d65476b299ccb51bf324c0474d400073d93fc577b8a0f419cbc5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646834949, "uuid": "fbaa3b45-7e8b-49d0-bae7-ada8403d026d", "value": "T1ED44023525E92A2DCDD60FF8E5C823001FBC89D6F49AE64EDF2071D229935C4779983A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646834949, "uuid": "8e8bc610-fe8e-413f-aa31-d7afd22d08b0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646834949, "uuid": "61e4a8fa-3134-4680-8f49-d842d3b7779d", "value": "6144:Hqz2DwtDgMhWB13POi0TMb9RsxrtFkTcbDJp:KCMVqBtPOi0TMRkFks", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646834949, "uuid": "78889402-9df2-4396-912a-5cbd83547040", "value": 259584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646834949, "uuid": "e615a04e-14e5-448a-85a5-23c5e8b6c9f1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646834949, "uuid": "7d36f01a-077d-4ffb-bb88-926f56297e3f", "value": "Quotation Detail.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70a24774-9fb5-11ec-9275-42010a9c0029", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1646836216, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646836216, "uuid": "38191f62-9ed9-48d8-8c05-3f07f8a8066c", "comment": "Malware payload (AveMariaRAT)", "value": "db1b1f5c3fd8ee957b27f9688417e84f", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646836216, "uuid": "24d96a2b-bb75-4001-beac-4d3918706769", "comment": "Malware payload (AveMariaRAT)", "value": "8fd2d590487f9c781d57cf53186e0e713e06095bf7c71cc442ec349f6a1f5c9b", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646836216, "uuid": "7df29a3d-4d75-4fa2-ab55-88e5171e4e36", "comment": "Malware payload (AveMariaRAT)", "value": "e3db78f4eefccaa0b1ce9da01060503b386a5d50", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646836216, "uuid": "36af58f6-2c65-4aee-a13a-466c79f33626", "comment": "Malware payload (AveMariaRAT)", "value": "17e1fa488f52d19964b19f0224c54ec3437d122377ca02467a971e9ae5ed87c02e902cf1d442e468f25e61388d552e9d", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646836216, "uuid": "b4b876ed-6f6d-421e-9d31-25a69fbed1d6", "value": "T131057DEEB3E24432C1771A384C1B9674592AFE142F2469472FF87D0EBE746913939293", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646836216, "uuid": "973761ec-6316-47fc-83bc-9a4be4469a05", "value": "ef548b3863419e317467c122fcc08ed7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646836216, "uuid": "0f3c2adb-431d-4bb8-9131-987a9d35e14c", "value": "12288:F9udXq5lwIfJhsVoyv6g2ddE8mgPJP89Q+zl/oRIlRfk:zudXehgWT4gPNmQ+h/7f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646836216, "uuid": "19980536-1001-4f58-8292-322eb3533be5", "value": 836096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646836216, "uuid": "f5e22e9c-50f1-4218-85b9-30323f601af5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646836216, "uuid": "4e5f1665-396c-49c4-90d0-8ac73c43da58", "value": "db1b1f5c3fd8ee957b27f9688417e84f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19b4bf15-9f90-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1646820179, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646820179, "uuid": "0a05529c-823c-4669-a890-749fdfee0038", "comment": "Malware payload (Loki)", "value": "92671b0a587492164381d3352a075f37", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646820179, "uuid": "67aa278c-7f92-4ca7-b895-dcd8cb855697", "comment": "Malware payload (Loki)", "value": "8fd730d159022d6d231ef67ff5da12f800e8376cd511ba854df504efdef94c05", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646820179, "uuid": "ad37e95b-c873-4c13-89c2-836062a9a8ff", "comment": "Malware payload (Loki)", "value": "c8c1d2cd6576f9e09d9fb172ba81556ce7edae7b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646820179, "uuid": "b9a74e14-9ad2-49a5-a383-c988204f22f2", "comment": "Malware payload (Loki)", "value": "f12a2dcd276f21111dd9785793b28ef4e8387a193583f2085e11b55484d76c6dc9e8e69c6f88d999d7e0f1fb030cd09c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646820179, "uuid": "9b4f27a6-d513-40bf-bf6e-6d1709e4782e", "value": "T159F47C5627D97F44E07FBB3CA678048447F47A0BEB21D29E3CC540DDBA32E815A52A63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646820179, "uuid": "3d37015a-37f3-4fc6-b8ef-a3f8e92bf23f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646820179, "uuid": "3ac4d1ff-cce6-43db-9fe5-59789c9ec93a", "value": "12288:BoOwvARzW3ZhOENuB501VEUxeDXh/bDKnGPtFM:BoOAAlWJhOdBKTE9XPtFM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646820179, "uuid": "95186cdc-740b-47b0-aa8c-e9c9257e23ad", "value": 751616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646820179, "uuid": "71628514-d919-4a64-bf77-94d083d14ce6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646820179, "uuid": "c0b960b2-4cae-4726-9f77-10a8cd6e0679", "value": "Order #6333-1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8e6eab2-9fc8-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1646844605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646844605, "uuid": "f8883ca1-e89a-47c5-861e-d12695f5f4fe", "comment": "Malware payload (Loki)", "value": "4543faa15f247330161f358a57736067", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646844605, "uuid": "e9aa0cde-ceb4-447c-8f7a-4b4d7c189105", "comment": "Malware payload (Loki)", "value": "904b76bb1470d51bf702e5a09dc80b49074a5963970a06e8c3ee4d58d98e2601", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646844605, "uuid": "263e109f-7d45-48bb-af0a-1e6a1c26fb2e", "comment": "Malware payload (Loki)", "value": "05d837cbafc4121239d19981468e4cf668ba6473", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646844605, "uuid": "3debd7d8-55e3-4c4e-93c1-e90aa1e8cdaf", "comment": "Malware payload (Loki)", "value": "b85be37bc4864cd24ebdeaa1329f92f6b418bf42d3d25f9a41dcb49eafa2587a399fb6b3e1a79c4388ce83300d1950ef", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646844605, "uuid": "fd7d47c9-9ac2-4d87-949b-f35126abdeb9", "value": "T1A7C402193BA9DE1FD2861F381AF1F324A2759DC03E234A47BB947B9F5E316892E441C4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646844605, "uuid": "7daa20a5-790c-439b-b7d3-51fd6352c398", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646844605, "uuid": "1b4ac310-b48b-42b0-ae2e-0c2a3d38588c", "value": "12288:mSWE+dmwP8igv5Vz6sRGGgcyh2gPxR6su+gb6b:mSWHdmwkigxls5Zxot6b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646844605, "uuid": "41d37b0e-b6e2-499d-94bc-d60c37988411", "value": 568731, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646844605, "uuid": "f1ee017e-6a37-4f9c-9feb-14961a78df52", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646844605, "uuid": "b11b20a4-1088-424f-96b5-d6b9dada277c", "value": "4543faa15f247330161f358a57736067", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a4a5763-9f9d-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1646825952, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646825952, "uuid": "18df7720-aa24-4cb8-9a5e-4f4c4769ed02", "comment": "Malware payload (Formbook)", "value": "21b8adafc63051777b0d97f530aca8b8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646825952, "uuid": "995b7fee-f3b5-4d5a-a441-c26b4e488ba8", "comment": "Malware payload (Formbook)", "value": "90a995e5f46d21ee81b12ea412a68168fa3bd9b3def1c23f310fec53f007bf77", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646825952, "uuid": "39f52936-e7d9-4e74-82d9-b85bec1bb925", "comment": "Malware payload (Formbook)", "value": "fa1ece5e2bcf45ac4676c354e61046d2eea14bbf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646825952, "uuid": "08d4af1f-b2fd-4825-99d0-59b2c02bedb6", "comment": "Malware payload (Formbook)", "value": "27189ab5db0c88dfab663d9f025be0c80c5a70cc5c7099a28e529771755718a296ebaeda61eb5c55cfe2c943c64b23e6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646825952, "uuid": "fa449e6c-b15f-465c-b232-e8ca3cb39212", "value": "T12125BF00A9DA503AF52A6AB91BC1BD3719D7B96E0414E0BE2C5CCA894FD177C9DC0F72", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646825952, "uuid": "63aed443-0483-4ab3-8159-eb2a3e38589d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646825952, "uuid": "a44a511a-3099-4944-b9ef-5b8da0263469", "value": "12288:O09gSuJU13Po6NoHtD0TmqAAnCBcTaQKxQiagcdCuE8OWWAmjuwPIIBV/st6CyvL:O0SSfW6NgDS8bmyYoWTmaIBhsAXFdge", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646825952, "uuid": "731b1ac2-e7dd-454e-8e95-150079b4c7a5", "value": 983552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646825952, "uuid": "c1cfc4fb-9585-44a7-bf56-1fdda4773b65", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646825952, "uuid": "2dcd563b-0200-4f4f-ac28-92d5c4e89b39", "value": "PDF.RICHIESTA FOB QOUTE $$$$ PO3457H.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "616cecfd-9fe5-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646856807, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646856807, "uuid": "ba32b3fa-c835-472e-ac51-8f71c7029e9f", "comment": "Malware payload", "value": "f24a239992856832a14d1546fc4cdda1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646856807, "uuid": "131dc44d-9316-4523-b5fe-4b98aad82104", "comment": "Malware payload", "value": "9262509414f88ba8a7ea799a041bdcab8c68c502917fa5d66cd39dbb940cea15", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646856807, "uuid": "8ef0acdd-a7b4-493c-92f5-4b21350158f3", "comment": "Malware payload", "value": "6503bbd766e9ba94e9b25c1a2cf433abee12a764", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646856807, "uuid": "7bbaa39f-8419-4cf2-96ce-dd774ce7cd84", "comment": "Malware payload", "value": "93ca09e2b1e73857b2547749cc83a9e4fac1a0b1168369cb43e4d09d620f1b9bc2126574e723f79c2890b32c74daef33", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646856807, "uuid": "42f04727-874c-4629-8482-11b11298464e", "value": "T10F44CF4177649A63C56483398CE7E3F65B30BEBA6F01574B7298F39DACB63884C43085", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646856807, "uuid": "9fb05086-84a3-4b85-a8e4-676f8a7334ce", "value": "3072:dRHs7bZW1uCroNcGK8R6bav95snlv6sTfN/2jh/znbVxyZ0r:dRabEpEeVbbaXG6sLN/QLnb+G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646856807, "uuid": "58c5619a-032e-4863-8e5e-191efc62ba9d", "value": 253952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646856807, "uuid": "d69cd67d-8aca-4d66-a751-05c44abd86cf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646856807, "uuid": "5a8da3d7-9104-42db-9a32-1adfe0ce9921", "value": "f24a239992856832a14d1546fc4cdda1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8084c146-9f9d-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646825935, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646825935, "uuid": "4d455eec-1eab-4dd1-bc2a-25376989977f", "comment": "Malware payload (Heodo)", "value": "5db79bdd1ac05a159f3f6c2a8c93747f", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646825935, "uuid": "b8b11701-d9f6-4454-969b-9dfb971a739c", "comment": "Malware payload (Heodo)", "value": "92aeace70d666f4324bc10729495174b6a0e0ee174c43a45cfae071cb2e6c7d8", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646825935, "uuid": "b0402437-d82d-495e-9bfc-74d6fe2f16b0", "comment": "Malware payload (Heodo)", "value": "cef439004a00c6e7d850a6d8da71eedd90a62459", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646825935, "uuid": "210b1199-5225-408b-8757-d03675a6f562", "comment": "Malware payload (Heodo)", "value": "3778d15e187d1982896293ef57c371b2735fa91a8e69a37c61c257c6f33bd519f05213ce8275c7ac54659c8d8bd98988", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646825935, "uuid": "ba8d8922-cd87-493e-a630-6693af517c3a", "value": "T12523E03CA042FA1CE266797D920C48E6960D21617045A56F3A0C7F6D2B869E70B1F7EA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646825935, "uuid": "1d04a1dd-7023-4436-9008-2cda1c86c9f4", "value": "768:jO+CAEWvxRc3mlkKDNWBA7rTj+RYV8Q0RuVBR2jPrtysHRX0AOBAa:j7O2b8QkKDNck01u/R2rZyjtBl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646825935, "uuid": "b19c4e4e-2029-4679-ba6e-e309d8f0e620", "value": 49573, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646825935, "uuid": "8b245ffe-909b-4f45-a9a2-2d5a064fadff", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646825935, "uuid": "5fb81364-06c7-4f52-8486-83daff401246", "value": "554557964.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52cc38d4-9fbb-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1646838743, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646838743, "uuid": "95027484-b9f1-4610-8be9-fc3dbe63f887", "comment": "Malware payload (AgentTesla)", "value": "3c6b8875322086f9745ec1b5ad942724", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646838743, "uuid": "8400bebc-1ffb-431c-851f-d4a03ad6e8d6", "comment": "Malware payload (AgentTesla)", "value": "92f6dd6b9c8decf16d47e422f8246e0554c9066ecdaed04ab0f77f26ad5a1862", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646838743, "uuid": "6bee16f2-4747-4008-840d-05a3ad0bfc9d", "comment": "Malware payload (AgentTesla)", "value": "a05b74afc0a378c18f18240b456b75cffb755969", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646838743, "uuid": "87929c08-b49b-466a-83ab-41c10da4e072", "comment": "Malware payload (AgentTesla)", "value": "d9dfa76d35c70f531154f7ffadcdb3b4513457b4502973d0b542902d793c0a91ee65b25d71bf1ce34258257f35701f91", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646838743, "uuid": "5165027d-892b-492d-b95a-7319eab597c5", "value": "T15725AEE629EF105DF3379BB13FC8F8CE996AF933151A609B14922B364423990CD61B35", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646838743, "uuid": "9a3a4b19-76a1-4ba3-957e-ed338219225e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646838743, "uuid": "1411f304-f3ba-42fd-95f7-bd8d3ef160af", "value": "24576:MD5k9B8VHckyH21C6ZuqNIQsBwwqrYEmrx96NI:MD5k9BoiVqNIQs6wq436", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646838743, "uuid": "06f977af-df0d-440d-a1ff-12db0a7ab36e", "value": 1010688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646838743, "uuid": "3b52bd96-3e31-47b9-ada5-b91b3f4ce1d3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646838743, "uuid": "0e9c2b1d-7c30-408d-8025-3c5bd8468392", "value": "DHL Shipment Notification.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7083390-9fbb-11ec-9275-42010a9c0029", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1646838992, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646838992, "uuid": "14e62560-6ee4-458f-91f5-9a4f79550fdb", "comment": "Malware payload (ArkeiStealer)", "value": "18daed337323adb64acf5eb52d6f3c81", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646838992, "uuid": "00167d64-cc23-4820-9113-bac30962b6d2", "comment": "Malware payload (ArkeiStealer)", "value": "9443936000c840af0f4bba67d8e91f8e2e86de6585df8a97f1d50176738091b5", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646838992, "uuid": "2635a708-da78-4911-a918-4f455320fdb1", "comment": "Malware payload (ArkeiStealer)", "value": "dd9f3fa18e04048f9da5abbf06cc506db30517ec", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646838992, "uuid": "baf14612-7705-4f0a-bce7-3b8cbd2a9b67", "comment": "Malware payload (ArkeiStealer)", "value": "3de41acec20a0646347faebd779ac2ef5d5ee7cb13a7b991e58a9f8dabb6519e8937249558975c382663904d39f7ab38", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646838992, "uuid": "3aef7a5b-176f-445b-8fb7-be8619750c4e", "value": "T1A3849D10BA90C035F5F722F859BB936DB52E7AA19B6450CF53D52AEA17346E0EC3130B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646838992, "uuid": "46bbc5da-c613-4714-a7ad-0c943590a99f", "value": "da87ed787b504389105de3ab7df646d4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646838992, "uuid": "84551233-6ca3-45e7-a886-d7cb8a74c577", "value": "6144:45md1rWDODpvt0rtwddyN0HHwiLSEdRTliWuzpwvDtKJXqRizg:4sjWDODpvKBwdUN0nSEdJl2Ue/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646838992, "uuid": "3c7d2a1f-2ac0-4085-85d9-3f96e97425d3", "value": 376832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646838992, "uuid": "382cc8e9-2e21-4e89-b0d6-c00e6a9a286b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646838992, "uuid": "4c1d1e12-8b08-46ec-9e19-3b0e79fe6489", "value": "18daed337323adb64acf5eb52d6f3c81.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42ad8149-9fcd-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1646846447, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646846447, "uuid": "3dc5881d-aaab-4c7c-9bd5-fba1267de4b7", "comment": "Malware payload (Formbook)", "value": "711fbe44a0f4b97918e664b09bac892f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646846447, "uuid": "58587289-0354-4ac6-b201-469adc1750f1", "comment": "Malware payload (Formbook)", "value": "94e8308989d63f75b02e89c5d30e01d9d7dedbf7bb446d3aa6fb83b6e20bcecc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646846447, "uuid": "e4781d92-dc30-4d10-b61b-ec0e7c38669f", "comment": "Malware payload (Formbook)", "value": "45d106510571f88078ac89ae796390fadf22c1ba", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646846447, "uuid": "28513593-3bfe-49eb-bd9e-51b85fd719fc", "comment": "Malware payload (Formbook)", "value": "1ec8ee154a6a5c2d2a292b9d263ae12edae91ab723dcb1eb42f899b0bdc3e7b36677e1cd8341880af47cae028da3b3f5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646846447, "uuid": "491edffa-0867-432b-bf04-dffd31504df6", "value": "T11EA4D00FEB9A8099CE14377EC5B6E3208704EA75FA57570751D6BEED29372C978800B8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646846447, "uuid": "77e8257f-c8c4-4aa4-8dcc-d44386fd097d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646846447, "uuid": "66868915-ca48-475e-9417-8cddba72a550", "value": "12288:jJhROX1dryqQUGiDGhCu2kNvO8ktmZrTYnwgd:js1dTtqL277tmBo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646846447, "uuid": "3e32cfa5-6e0b-4c7c-896e-844c5a0a4d5c", "value": 452608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646846447, "uuid": "3af5fb80-6474-4875-9e89-1cd905ed8e8f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646846447, "uuid": "62586ae2-323b-4380-a709-50a29f351ff2", "value": "ccc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "878f9de9-9fbc-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1646839261, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646839261, "uuid": "5fbd833f-80ac-4b6b-92f4-260ae505e957", "comment": "Malware payload (AgentTesla)", "value": "ac96218cecfde60f1e096733d1ca4cf7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646839261, "uuid": "eb3d5531-2774-4ba1-9858-a282cb0878aa", "comment": "Malware payload (AgentTesla)", "value": "954d7cd522bd82b72db7e3767e2bf13b2bddcf384daea1739d3bbf9545c739cb", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646839261, "uuid": "ca6cda2c-c981-4dbb-b3b1-d17a443fadb2", "comment": "Malware payload (AgentTesla)", "value": "a2b259ae1f54772482ce103b60cc18ff27269622", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646839261, "uuid": "f3a45ede-10ff-42ef-8da2-97de39013788", "comment": "Malware payload (AgentTesla)", "value": "31d37ea1780f70c2079d21e88273da48905d5727b28eef851d7758ab65b8366485b4b460f18e01193ea2e17106c3e951", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646839261, "uuid": "5470ad91-f84a-46a6-9045-878b398ddc5f", "value": "T13D35AEE629EB501DF337ABB12FC8F8CE996AE973161A30DB10510B768523E80DD61735", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646839261, "uuid": "e9e775ef-bace-4af1-8f8c-8e37993ab323", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646839261, "uuid": "af8fdbcc-9ace-4142-b23e-ae92e2c4c515", "value": "24576:3D5k6ziWs8+dymAiO51+LVt6ZRDJ5owXaS6:3D5k6eWs8+9aw6bMwXP6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646839261, "uuid": "738bdb58-02a5-4e84-820b-9913845d0b8e", "value": 1095168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646839261, "uuid": "761b87eb-d09d-4ffe-a17a-465afb162823", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646839261, "uuid": "cafc4364-f986-4578-8618-6d408d16671d", "value": "ac96218cecfde60f1e096733d1ca4cf7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "009c2b62-9f61-11ec-9275-42010a9c0029", "comment": "Malware payload (Smoke Loader)", "timestamp": 1646799951, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646799951, "uuid": "30a87c9d-214b-4592-8948-23b593771172", "comment": "Malware payload (Smoke Loader)", "value": "d9a418a4a8e02683c79daeaadd464595", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646799951, "uuid": "5c5e7df1-7ce5-47c6-9a2b-066f64debf65", "comment": "Malware payload (Smoke Loader)", "value": "954fdefd2dd5cf44876783f51cf35edef3fb790ed3ba777c1bfafb13680a1ccc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646799951, "uuid": "52166dd8-45aa-4223-84d5-e912fe13f94d", "comment": "Malware payload (Smoke Loader)", "value": "9f53b07cd8488dd9a6fcd73945b1ba2cd9e7f254", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646799951, "uuid": "3fe5bd16-04e3-4fd0-bd2b-c7c8f82b7682", "comment": "Malware payload (Smoke Loader)", "value": "46cb0f65faeffba1c663e635bfc26e4122f82876490b25ff4feae071c4e2ed487aa2a61acb329cce161cb65899a6e6be", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646799951, "uuid": "e738e5c1-3053-42fc-84ae-b4ea789f5cce", "value": "T12F549E10BB90D035F5F716F8567A936CBA2E7AA05B3450CB52E56AEE47346E0EC3130B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646799951, "uuid": "dcc5e5f5-68b0-4ba2-8407-16824dea8e3c", "value": "3eef4090e823297f158db506eb4add6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646799951, "uuid": "56fb3c0b-b95e-4da9-9bdb-5f6ceac45ebd", "value": "6144:KyHtj9Ko6J575ehCATQjX7nJ9BnvxT9fXDwfd1xfC8N:nx9Ko6Jp4hCeQ3J9Jv5hDwfd1x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646799951, "uuid": "258fd471-2f4d-434a-a8aa-aab60f0085b8", "value": 294400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646799951, "uuid": "4dfd6f37-ba86-4376-9ab3-73b927b10651", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646799951, "uuid": "cb0663d8-b391-4755-ae4e-008f44ab1e2a", "value": "d9a418a4a8e02683c79daeaadd464595.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3912476-9fc3-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646842449, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646842449, "uuid": "f96a34d6-06d5-4469-b463-1bfbb5544d90", "comment": "Malware payload (Heodo)", "value": "f75d7c95d1bc9e0cef8b5f39f1ba0746", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646842449, "uuid": "71470f19-b3ff-4319-aeff-20253e799743", "comment": "Malware payload (Heodo)", "value": "97793fe1745ba7430da211d0e0132eba23a0710150f1fc41eee428d943ccb7b6", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646842449, "uuid": "720c2bdd-05a4-4bf5-89e8-0e68ab048859", "comment": "Malware payload (Heodo)", "value": "5d6273a961c2e369e0288959dc73857601320510", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646842449, "uuid": "0e80b50f-1b33-4099-9631-fee5057d8053", "comment": "Malware payload (Heodo)", "value": "711437836fd3713c858515fdbd582b5080f0df6ffeeea637ccee1761d27795efee4b53ae9da34789cb1453107480da60", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646842449, "uuid": "f1933038-3643-4306-8c5b-7089be16f047", "value": "T1A6257C107E8A817EC71B85B30836676D6FFEAB204B6CA1CB478175ED2D316C29B36705", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646842449, "uuid": "07f7898d-9a4d-4fce-8294-56af532240e7", "value": "087c9809507dfca4c3283e6c7539e91c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646842449, "uuid": "b2e7e1b4-c86c-4f3d-b344-dee70f16bdf6", "value": "12288:cR5SOyRHiA6m0OcEljzt6JtcS1j2xKkr:cR5SOrKljzEtcK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646842449, "uuid": "f242bb34-d077-4f8f-8da6-eed3ca4b7381", "value": 1040384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646842449, "uuid": "886a1a9b-8c28-4e90-9dd9-75030b2463b0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646842449, "uuid": "791f8836-fd4f-4514-a837-6b05c8adb4a9", "value": "tbp.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9f899b5-9f98-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1646823938, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646823938, "uuid": "27742baf-c0e9-4ccb-a9b9-63d88eddafe4", "comment": "Malware payload (AgentTesla)", "value": "4c97dc9dfc1c59d3ed3a60afb2ecae6e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646823938, "uuid": "bcc1743a-f1fc-4510-93ad-7c8a087eb498", "comment": "Malware payload (AgentTesla)", "value": "9782418eab2017fe388d12fb5275223ca1d159a5d1df35ea59642eadb313ec52", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646823938, "uuid": "4a644458-bdbb-4a89-b5d0-ffa9ce986809", "comment": "Malware payload (AgentTesla)", "value": "8e2f293a601fc2f1d33828b586f18574a4f295b1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646823938, "uuid": "2030c921-9b84-4939-8b63-f63e2a2b0be2", "comment": "Malware payload (AgentTesla)", "value": "2890406fbdf3d3976f3a74c8cbfef503f6bc71db8b32ca5531550046ae8661fbea8e5368bb0f5c034ff46ded1f469450", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646823938, "uuid": "4c5c5cf7-1827-4369-af66-998a39660dea", "value": "T14725AEE629EF505DF337ABB13FC8F8CE996AEA73161A30D714521B3684239908D21735", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646823938, "uuid": "d2d0aa59-a7cd-4e70-be2f-37701830680e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646823938, "uuid": "3692d8d1-f724-43af-bde4-a66a3735141c", "value": "24576:9D5kPVg0dmfXZhswEKxj8vE0RAfiK5LJI:9D5k8XMKxjTyA6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646823938, "uuid": "622d0598-240e-4900-9ef1-b58c6550227f", "value": 1019392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646823938, "uuid": "c29797f0-dbc6-4fdc-8603-b12a57e1d799", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646823938, "uuid": "7d9eb4c5-554b-4006-924b-2e5d9097bc65", "value": "INV NO - MPS1421-22 DT - 18.02.2022.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7dcaadaa-9f83-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1646814764, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646814764, "uuid": "88696ad8-22dc-4f01-a3f9-503ddcc81e6c", "comment": "Malware payload (AgentTesla)", "value": "2f5d038e62aed14edada8db233ae335e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "r27", "colour": "#23853B", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646814764, "uuid": "e25ac4cf-df8e-4f12-93c4-cc2a47957cb8", "comment": "Malware payload (AgentTesla)", "value": "9798713e9b61648f47d7279cf5be6c35ce0f0be82cda63c98dcc3a829f6b2cd3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "r27", "colour": "#23853B", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646814764, "uuid": "05eb9124-ce2d-4294-9e79-d37bf17ebb2a", "comment": "Malware payload (AgentTesla)", "value": "599b7f2ee0ef72804c74ce1a7c00392430c16ad2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "r27", "colour": "#23853B", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646814764, "uuid": "adb9097d-0f10-405e-8161-6b98c574424f", "comment": "Malware payload (AgentTesla)", "value": "029e331499b059d65bc83bbd82091ce17299a948ddf0090073d52f1b1a6aaabc650785e8521466bd4df7d15c6a06767d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "r27", "colour": "#23853B", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646814764, "uuid": "8834f3a8-fdae-470c-afbf-e213d7d0f13d", "value": "T1D3F433DD0FCE73EA57F9A82F040DB21B4B48AC4B874D12C9DC1A53E1395CA9B2A544F6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646814764, "uuid": "17850fcb-0681-4f87-803f-d5ee37820ef9", "value": "12288:0r4waiMhUTBfxlZY/GBFAX5rxaPAX/sSPusBUjWy9hLlwf6Sg+gr0S2zveVUbeAe:0rjMyT9x4+TAJ8PAPHMNlW6VBr0S2b+3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646814764, "uuid": "597b78fa-37ac-4fc3-a12e-aeb12f96d98c", "value": 766113, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646814764, "uuid": "10124e3b-123c-4e0f-9058-c8b44792845f", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646814764, "uuid": "d55da17e-3992-4c90-8427-600906e69c4f", "value": "4 Pallet Shipping Docs.Commercial Invoice. Packing List. Bill of LandingTHS009458721972.r27", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68886637-9fb2-11ec-9275-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1646834914, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646834914, "uuid": "f59e1fb9-8c21-4feb-9057-a35d35073b95", "comment": "Malware payload (SnakeKeylogger)", "value": "b0f5e0e5f525d56fa0d16bf837bcf8e3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646834914, "uuid": "8aa2f197-8ec9-4724-a07b-9613f1a2e20b", "comment": "Malware payload (SnakeKeylogger)", "value": "979b0adf97801885c67215a5d017a14f4f6cf6f00a2b3cad157b22f18dd50ef5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646834914, "uuid": "9ed25093-3876-4845-bc0f-d62b6669aa5b", "comment": "Malware payload (SnakeKeylogger)", "value": "146381672a256bb61eff7637ed2bb63c86036d39", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646834914, "uuid": "a851c357-6243-4f45-9b74-23b3f47aa6d1", "comment": "Malware payload (SnakeKeylogger)", "value": "abf82498483f72706d87f090840132536625d24f273f7e9f0b493ef4d3e9c98b34c70c167a117524c14efa636d44bd4e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646834914, "uuid": "d851d621-1f12-487b-8b2b-c9e5b48fcc9a", "value": "T1A8E4939C312031DEC96BD6759AA81D68FFA03C7B831F511B902731AD9A3C987DF245B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646834914, "uuid": "c792a1f5-171c-4eb9-a005-32b7fe6929fd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646834914, "uuid": "3cbc6e73-24f5-4b40-b7a4-22b50cd83264", "value": "12288:zrqcpw0ueR1MhvwiBw3VYQ1WtQxaQ0bwQcX90096BipItWjBerBkb+9c5kL/0hRF:zlXRuFwhDU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646834914, "uuid": "8da07834-4404-471e-8301-27fb9a64f1df", "value": 666624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646834914, "uuid": "45ad61b1-ecc4-4746-88e9-cc998ce7c9fb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646834914, "uuid": "090949e8-4c02-46c6-8336-da834cadb5b0", "value": "Dekont.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd369b7f-9f86-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646816212, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646816212, "uuid": "8c051a84-4bc8-4b60-971c-2d422fcca7e5", "comment": "Malware payload", "value": "6cb4e946c2271d28a4dee167f274bb80", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RURansom", "colour": "#71CD12", "exportable": true, "hide_tag": false }, { "name": "Wiper", "colour": "#614E92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646816212, "uuid": "1b93b619-e7eb-49fb-8410-4f64cca4ef0c", "comment": "Malware payload", "value": "979f9d1e019d9172af73428a1b3cbdff8aec8fdbe0f67cba48971a36f5001da9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RURansom", "colour": "#71CD12", "exportable": true, "hide_tag": false }, { "name": "Wiper", "colour": "#614E92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646816212, "uuid": "aef1ae34-fa95-41c3-b057-56cb782fc733", "comment": "Malware payload", "value": "0bea48fcf825a50f6bf05976ecbb66ac1c3daa6b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RURansom", "colour": "#71CD12", "exportable": true, "hide_tag": false }, { "name": "Wiper", "colour": "#614E92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646816212, "uuid": "7a96b0e4-573f-41b1-adbb-72e8ebaa2e0f", "comment": "Malware payload", "value": "c9704c19bf26c9c0f9d50b93242a06643eb0dde4da67158cd7c5d34336b93e2fef05a26f02e90476b40b6665172d063a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RURansom", "colour": "#71CD12", "exportable": true, "hide_tag": false }, { "name": "Wiper", "colour": "#614E92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646816212, "uuid": "aaa568ff-5ca2-435e-993c-cdd9a9e1f73f", "value": "T1D942090BA6E88130E57A41762DB783C2C735B7475905DBAEB48E641F3F3222693633E1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646816212, "uuid": "86a2fd8c-be09-4fda-9c2d-1acb98bf94a0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646816212, "uuid": "3da2f03e-accc-4ba9-8951-ae697e07d99a", "value": "192:74GA4XSTFFJzJdaGJYXhkREOjkXnV8stYcFwVc03KY:/ANhpztmnVptYcFwVc03K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646816212, "uuid": "9601193a-7839-4c03-b862-0377086fcfc1", "value": 12288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646816212, "uuid": "ed1adaf6-c124-41ed-b1f0-7b0c7c6eff0f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646816212, "uuid": "d2e0d2f4-4766-48d7-b6a5-9fa7770e98b9", "value": "979f9d1e019d9172af73428a1b3cbdff8aec8fdbe0f67cba48971a36f5001da9.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c540f00a-9fc3-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646842371, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646842371, "uuid": "ab7aa245-0c85-4594-8a3e-47b31a879f86", "comment": "Malware payload (Heodo)", "value": "521dbe9563c2bf92aca8f9643124cbde", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646842371, "uuid": "9a9eed5a-5c72-471d-863d-2e76ecc80be6", "comment": "Malware payload (Heodo)", "value": "986fc5684211809429ab3ec984e8c063c8b56f82b6e865e405d2e6c8bcb50d7a", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646842371, "uuid": "afe13333-fcd3-44ca-ba42-59d6fae07349", "comment": "Malware payload (Heodo)", "value": "95793fb9014fae44c399e2b962bc134c9d6f8d94", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646842371, "uuid": "283de281-d7e7-4f2e-8e4a-ef6c1cc95cb1", "comment": "Malware payload (Heodo)", "value": "cee9f2f26875f57d2a7040b6e59ef73d9e925b0b627fa863a8863ee64165d1563e6b0cfec4da93a45b3d4aaad5856882", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646842371, "uuid": "97f6d2e5-40d4-458a-948b-7f5ff5e08706", "value": "T19813D02CE6573105D6319CBD560CDCF56E0D30A7550ADA8B1448BACC2FC2BFB12AF198", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646842371, "uuid": "b5ed06ab-c024-439f-93fe-467a995d5312", "value": "768:WFVCToSyUn+qpOw+pyZfQCwBzii1H/KNsH7meB1Id5qXkm1qVw0cyjA:WFVQsUnpOw+pyZfQCezfCNRejIdcXheg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646842371, "uuid": "6a77b0d6-9a9c-4cc6-af85-88db4e133460", "value": 44642, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646842371, "uuid": "de567f2b-902d-4054-98ea-6aed14d5f874", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646842371, "uuid": "3150b7d9-2bde-4d9e-b44a-e368da8b87b2", "value": "09032022.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3422fd5c-9f93-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1646821512, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646821512, "uuid": "60505759-702f-402a-93e7-8298bc55d2cb", "comment": "Malware payload (AgentTesla)", "value": "ef49541d4f647709b9b75c4f8c4aa4f6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646821512, "uuid": "aa520946-b84f-4e13-9d24-9204ec143832", "comment": "Malware payload (AgentTesla)", "value": "98717fe9f651006ede63f7ca987a683408b79db76900d638e76921e7aee3c0a7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646821512, "uuid": "b3517526-4b2c-4e91-9233-af79fde248e0", "comment": "Malware payload (AgentTesla)", "value": "95968b87520a3cf0a1f63a53098973d7a756dd41", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646821512, "uuid": "4c54fcee-a825-4711-b1f7-50b9fbde35a7", "comment": "Malware payload (AgentTesla)", "value": "340c66d52253fa6e73ea795c757b2c8a8ec471bff5881c8a202e35eedd0eba0e265e1161576350890adfc4f818a8724c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646821512, "uuid": "6c87401f-f7f9-42e2-88df-fb3d4de4f288", "value": "T15415E0983A50769FC41BCD37C9941C64A670A4BB530BE347A49326AD9E0E6DFCF250F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646821512, "uuid": "05a125e3-5090-4038-8e1a-b68b8ce709e9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646821512, "uuid": "e6980592-2bba-492b-a094-d59cbeeaec53", "value": "24576:W5RY61+kCglYL1pl1x8fRSGlOu/De7TE/dGeAFkxE:WgDLoSGQAVIki", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646821512, "uuid": "8a1b3db4-c704-4ede-8e58-c7758fa73696", "value": 928768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646821512, "uuid": "0d5de56e-fa16-46d0-822a-25ba0d0a949d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646821512, "uuid": "588f2898-1261-4d20-9fd2-49885c96c174", "value": "eOdNXdLjbggzg3u.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91afb3f7-9fa1-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646827682, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646827682, "uuid": "0b0ca272-62f4-427a-a5f6-a81d7185fcc8", "comment": "Malware payload (Heodo)", "value": "9e5c3bab7777d76cc3bd75a791686dc6", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646827682, "uuid": "8b241ff8-aa7a-4dd8-a841-947d6caca6be", "comment": "Malware payload (Heodo)", "value": "994a14388944b4b037ca12c263d65efd7324f2f0072cbccb0ad501b740c0154e", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646827682, "uuid": "c6b56e58-5d34-4548-810c-18c6be86de7b", "comment": "Malware payload (Heodo)", "value": "3432c7890123b2bead4b325ec3c87a2ab5720d15", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646827682, "uuid": "50197d35-970f-4518-b547-15226fbb5b15", "comment": "Malware payload (Heodo)", "value": "bf0b0042f54004cbd5e7c38b70a3e4dd1e242c52a0b3808ef3ddcc586ac5ac1108a966926a518d30e2bbe8689bf9b435", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646827682, "uuid": "d49608fb-7246-47b8-ba7c-7e9d5e1eca71", "value": "T13C058D8FF7C0E1B9C25B3337B1045FB5369F68314A62915FEAB2467D9A315829E28307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646827682, "uuid": "7d5ca7e7-4ba0-4032-99b6-ca1b2a2a31f2", "value": "da43c7a1230b5e9633dee3bb298abbd5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646827682, "uuid": "15b87958-bcb2-4a66-80df-8e26e0a60eb7", "value": "24576:rtKv04BWEZaRb0hr4M29nJ1d/nThfhdQyQ+/s:4kba4MOn9hxs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646827682, "uuid": "3e292e42-e783-42e2-8c3a-95ff088f4df9", "value": 808960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646827682, "uuid": "86007c35-8834-472d-aa3c-878b9d48e1bb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646827682, "uuid": "a26efcee-b8df-4d43-b0e1-186cc214cc29", "value": "lwy9PXgRx6.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53885384-9fb9-11ec-9275-42010a9c0029", "comment": "Malware payload (GuLoader)", "timestamp": 1646837886, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646837886, "uuid": "eb6bc6c3-562f-435b-a6c0-861178b2a3e5", "comment": "Malware payload (GuLoader)", "value": "68a2b5e5e491451a8ec3306cc1e8bbd4", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646837886, "uuid": "5b6408a6-4753-4c97-b5b2-f7f0d3bacfba", "comment": "Malware payload (GuLoader)", "value": "9982e2b2669fed19e1a17c19f36bde0f25cc6d44dd9e526e36202adf04e0710d", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646837886, "uuid": "13046998-aaac-46fa-a083-6d77ebcb2f15", "comment": "Malware payload (GuLoader)", "value": "62d337ecd90b5e26309342f1f887be0a291fcc5f", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646837886, "uuid": "50647b53-4017-451d-a66c-e645909a1ddd", "comment": "Malware payload (GuLoader)", "value": "b6da7ee786aa846c953926dd7448007af165c020a0e47e935986d5f52ed4401caeaea0df1dc1bb928699e2c48502a271", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646837886, "uuid": "7b05a896-33e5-4f65-8ce8-818aa1acc136", "value": "T14343F4135732E9F7CA8D3D53A8191A4E7E78CDDD6F1CA22BF42088DCD911264BE582C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646837886, "uuid": "a20c7553-6788-4e1d-a375-992ac4585401", "value": "768:2yQZIR2Kq69hCYFkhwEuk/VkFbXJSuengDjP3Jwsl1aCgrFzB2J/TrUSy3x5:2yQyJq6F2+lx1ynmjv2VFB2xTrzeH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646837886, "uuid": "535e801a-6b5c-45e4-8f00-5fbcb46cc2f8", "value": 56677, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646837886, "uuid": "d14f19c7-410f-4db2-a6a6-fcdc3bb142f5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646837886, "uuid": "68298fa3-9811-485d-9e5e-2f533fa70bf8", "value": "purchase order ARSHAD BROTHERS.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd0e364c-9fc1-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1646841499, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646841499, "uuid": "47225e58-b672-4e7f-b546-15548de739c6", "comment": "Malware payload (Mirai)", "value": "1a8763a5f536ac050a442d740db69e20", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646841499, "uuid": "aa1da924-8c0f-4f0d-8cc3-12a05567d3ce", "comment": "Malware payload (Mirai)", "value": "9a1afb071e44c50bc48f57f67d12d5b8b8678d02b64d1c8f637a162e9a032cc1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646841499, "uuid": "3ea9f087-0155-4f37-b8d6-f3f4a79fd529", "comment": "Malware payload (Mirai)", "value": "173dfd5b823c815d23361b55ede40eda5ad94c81", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646841499, "uuid": "3e7d6806-7d06-4a3d-a519-88fc65a8b536", "comment": "Malware payload (Mirai)", "value": "e477e8823eb4ef99e64a5631bc7c5489581fb25d868e6191c3f32389540e8c27a5cad4b2aed2d68374840c334f9715bb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646841499, "uuid": "38d9ca87-7972-4508-b66a-c38bb3871320", "value": "T178837D33D8141F68D105597120F6DE3D5B237AC147931D72E19A8238AEA3DEEB226FE4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646841499, "uuid": "19d87576-517a-4b50-92c4-f559ba4c949d", "value": "1536:HjwKIW9zwmem/765J1nb7GH21Vv+bNvz2RJtzxRoJhja1k7STi9kbvcUci4K2r4y:MKIUwmPCx27eFO9BoTV5hw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646841499, "uuid": "e56c32a6-3240-4bd6-9aa2-94cb233b2ebf", "value": 87636, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646841499, "uuid": "462726ed-6f7a-435a-be5c-51abca6d2f2b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646841499, "uuid": "034836bd-462a-46e6-b695-24b55a477604", "value": "1a8763a5f536ac050a442d740db69e20", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ac2c88b-9f82-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646814356, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646814356, "uuid": "fc85287b-6bbe-473c-8c2e-90bc3d97285a", "comment": "Malware payload", "value": "89b34d4fbf4f07be7f0b6af387e8e8e5", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646814356, "uuid": "96d9e8bc-54d5-483d-94a8-2bfa7f5decf6", "comment": "Malware payload", "value": "9a7e5a3b0a5e3bc66a62ee890b9d151665e09409764c4867dcaf0652066be359", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646814356, "uuid": "d8555e32-34c4-4be9-b0b3-7f8f0ba7ea5f", "comment": "Malware payload", "value": "a5beb85ab0a116ca717accde03474b386b134517", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646814356, "uuid": "c103cecb-4593-4606-a6eb-ac129da89ffb", "comment": "Malware payload", "value": "9ee4f397b76caeb9d83723d6469225691e5fd4d62d7ca406c3e9a569130c6847bd989aad5afc999d8d697f52ba0054ef", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646814356, "uuid": "7b3632e4-b5af-445b-9e39-49b87963e9e2", "value": "T122D2E13B40B06A9DE1316FB711AA88315EBDDE46CAF1E93D414350394C35D099C79EDB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646814356, "uuid": "4b33c7e0-ff2d-4497-8422-24b97bfd8a34", "value": "768:yjNJ5RRcPkwFAP4k2xEaTlX56joZJO1zjm5si8rc7754jtztM:yjN3RRcPLG8dlJ63gt5gtz+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646814356, "uuid": "5090dfb6-6cae-4d40-8d84-4e680e6ae771", "value": 30548, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646814356, "uuid": "5b429f95-263d-4320-a05a-6bfd39c4bf4f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646814356, "uuid": "78d20cbf-36c0-425e-8868-23c80b58abfc", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e93fad1-9fec-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646859701, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646859701, "uuid": "84004f83-0c24-413c-a6a3-e9d48777d235", "comment": "Malware payload", "value": "0d20d30c1c69933c5dc6315560e68f5d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646859701, "uuid": "cb3c0b4c-fc7d-4a4e-b771-4a9b22ce1058", "comment": "Malware payload", "value": "9a9c931a412df86ea65b5228c9237d2e5e2199715858d8b4ae1caec6d5702131", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646859701, "uuid": "1abb2ece-1c9f-4012-a5f8-df0ec79493b1", "comment": "Malware payload", "value": "a655f3c9d67b2180d654d64fc8e4d48c3e7e869c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646859701, "uuid": "3f75274e-28e5-4454-996c-cc96507131b0", "comment": "Malware payload", "value": "94847b5072ea0dde594b6f7570b5bd097d7efd74fbc0a5a143efef72a12766e15c2e47c5da8e73a21539254be0325c38", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646859701, "uuid": "89ca7dae-8436-45a2-89a4-32de98d929d9", "value": "T194334D252FBCC881D22415BAE6F3C9F815E4FE11D42FEA2BE4D13E16353B352A51A607", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646859701, "uuid": "74b77742-8d9f-4e71-8d1f-dc4ea9fe8532", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646859701, "uuid": "76b14c2c-f25e-4605-ba93-b5b7675757ab", "value": "768:y4VcIxA76RP8mE1BRhRKTJnapP8VhRTsCs:/K0m6RPK3ETcCVTzs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646859701, "uuid": "62088c70-26a8-4a61-a45b-55d4ffdfeef8", "value": 54784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646859701, "uuid": "bdad1230-1518-47ee-9e22-cfb51b3d3c9d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646859701, "uuid": "6220f344-f4f9-4353-86f2-ce7e6a9ec749", "value": "Htrfwkj.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7387b54c-9fcc-11ec-9275-42010a9c0029", "comment": "Malware payload (Quakbot)", "timestamp": 1646846100, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646846100, "uuid": "ceaccc64-1764-43a2-938c-3290c1f34561", "comment": "Malware payload (Quakbot)", "value": "a88ef52031790083f509854920b6637f", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama164", "colour": "#6C68A0", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646846100, "uuid": "b096897f-beda-4b86-a75c-eb46beb63f2d", "comment": "Malware payload (Quakbot)", "value": "9ae6784aacb19be546ba5e1f1bb44882e8f9c8f692472947d2734afcd7d54e05", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama164", "colour": "#6C68A0", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646846100, "uuid": "1ad9245d-a8fa-42ca-a5f6-3e9ff6ab28a5", "comment": "Malware payload (Quakbot)", "value": "11ac0451343c042aaa3b12c658152484247bce1d", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama164", "colour": "#6C68A0", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646846100, "uuid": "6625dbf2-5621-480e-b8cf-a53804a1d751", "comment": "Malware payload (Quakbot)", "value": "d641ee2be208413879583484cdaa91468464098917866a5d3d3ff0cf36b18c311ee62f7dfec8f533a688d0cea48b80e0", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama164", "colour": "#6C68A0", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646846100, "uuid": "e97da029-c4b4-4350-942b-533b45000f2f", "value": "T135657E23F2C1887AD4761A3C9D1B739998BA79112D28F4C77AD44E8C1F37A433666393", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646846100, "uuid": "3c7247b6-0ca4-40b3-b652-4513263e1d9c", "value": "cf78a88c4b0403a976a85038ec51a351", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646846100, "uuid": "ab3b6c19-935c-4a2d-8533-0195b5943792", "value": "24576:LP2GXxd5hyXOZk/R8SoMbEYN54UUrW/tRJfJnOIU2SAHl4XoWSIgX4T:Lu8jI6kcYN9RniKKgX4T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646846100, "uuid": "d43f1d5d-1a0f-4849-9bf5-7bde9ca354c6", "value": 1502720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646846100, "uuid": "b492991b-404e-4943-9604-9435830b3278", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646846100, "uuid": "eeef16a2-b637-4fbe-92e1-0643d78bd928", "value": "4746280.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a69264f-9f79-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646810356, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646810356, "uuid": "cfb5a373-e5eb-4922-a5ef-5999b2f0cb81", "comment": "Malware payload", "value": "e33b0fca1b9d089bc8c2a45f7f139621", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "coper", "colour": "#EED7EC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646810356, "uuid": "b34ab087-9af6-409c-8834-b90f6518dbf9", "comment": "Malware payload", "value": "9be0d499cac12a9cde004ed3fc1bb5150d384c3678fb07adc67ef90bbf791298", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "coper", "colour": "#EED7EC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646810356, "uuid": "27a2df5c-ebd8-4c0c-a54b-b402ced02dcd", "comment": "Malware payload", "value": "d34936af19e7f4cd13202ce56da6e5c23d9c0e23", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "coper", "colour": "#EED7EC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646810356, "uuid": "f34db7b5-9ea2-4dbe-b38c-724f7c53cb27", "comment": "Malware payload", "value": "b7c90f070b0e69dc603cb5530227d354129461f5461cee563d56774afcc0f20a76ccfc340bced0265bc1e1010ee3ad15", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "coper", "colour": "#EED7EC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646810356, "uuid": "d9d49e60-8750-41d9-b1fb-17bdc7e198c2", "value": "T17265F1C6B7C16C6FCDB384350F9A8321A2169D57C786D30768907A3C6EBB7E04E49AC5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646810356, "uuid": "5e503b33-654b-4668-a1ae-0193fef71c4e", "value": "24576:Nmp4zLU+YruSBV5vxzLZmH2VEES2cRx0GXNVrEUv4vVVK2Zdy3gwuMd:Mp4zLPUuSBV5vxVmH4Elfx0GXnEo4vVK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646810356, "uuid": "40939cfc-dd36-4710-9637-0162c265f99b", "value": 1430270, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646810356, "uuid": "0838c5d1-a215-490b-a864-2942eae28a09", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646810356, "uuid": "8c0b4054-a635-4ff2-8123-050b3ffeecf5", "value": "psk.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85824997-9fb2-11ec-9275-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1646834963, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646834963, "uuid": "4982291c-8529-4c90-a50d-88232c14d766", "comment": "Malware payload (SnakeKeylogger)", "value": "811b57a6db5aeb86fa561ab510a21e0d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646834963, "uuid": "fd50453a-326e-4781-8dbd-db88cff94d00", "comment": "Malware payload (SnakeKeylogger)", "value": "9be4149e49efbdd6b5ef16744ad28072211b543f59d0fd322cf4c5a0281b43ff", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646834963, "uuid": "6e755ca7-9357-442c-b1fe-2de61a70c104", "comment": "Malware payload (SnakeKeylogger)", "value": "bcc953122a90f5bfd2f87cb3b2ae41b4a2546fe2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646834963, "uuid": "a43a4f84-975c-4a7f-9dfc-b03eee79f65a", "comment": "Malware payload (SnakeKeylogger)", "value": "c07d28cb24cd7bd2d5e0aa41f353fe8099779b790e3334c4935508eb843925f91285e557937da5cfd55b80d9a8b6da5a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646834963, "uuid": "0397a479-8b1b-4de9-9824-110cd1f86c96", "value": "T1EE35CF21A865137BF17DC9B567D5A8A30ED3B0721244B1BE2C2CD66A0FD4A3CCE85E35", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646834963, "uuid": "67c686f2-99b7-4d3e-8715-fc31759ea6cd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646834963, "uuid": "aa6fa30f-4eb1-47ce-b724-6bdc7a304697", "value": "24576:xbfHb2F7ym3BqlN5lp4kmaRCaMQ6WVmVYH1XevUSGq0Ygs:x+F7/3gfTmRFemVYV5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646834963, "uuid": "1708d35b-282e-4545-92c6-1be927f79a57", "value": 1134592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646834963, "uuid": "31ae0795-f896-414a-81a0-fa604e16fcce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646834963, "uuid": "4b49e3f0-5016-4d8e-a1ed-1cf496c1ecc9", "value": "OC HBN50918472.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39faa81e-9fe7-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646857600, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646857600, "uuid": "50ea24ed-37bd-4823-a0aa-b8aa908d38e1", "comment": "Malware payload", "value": "1ea0ac85d2ce2b68c7303e35df111e51", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646857600, "uuid": "541f7519-e5f5-4bc5-a65e-f8939d654f83", "comment": "Malware payload", "value": "9c284d496179894d96bbc6f86d6ad0022969f406c89708b3f07214e23ecbdb42", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646857600, "uuid": "5889dfed-0094-4e97-bedf-18f5754b9133", "comment": "Malware payload", "value": "e18da524379a73ea05391c311d929d5123e6c4cc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646857600, "uuid": "92653756-9bc8-482c-a3b9-73ad79c6a9f1", "comment": "Malware payload", "value": "2ee6c8900f4aa28196f789980bea48651da5868e7efed1a011d2c7a8f2ae5c7cab05688d219a1481175849f1c98005a4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646857600, "uuid": "fcef7f5a-da9e-4c2f-9192-ee8a233f7e3d", "value": "T19D249C267780C473C4D708B44074C6B87ABBB8625665494BB7A82B7F7F303D2667D24B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646857600, "uuid": "97df85c9-0aa9-4588-8dfc-1f30264c36bf", "value": "6719cea6e789ad7f2a4d4234a3635d2f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646857600, "uuid": "fb967bef-f70a-49cf-aa8d-cbccfbf56a36", "value": "1536:I4//g4y07U/pL6Y4PN3Cmzr+xpC3cCQ8tpHw0eMxerJoGRQaNx5BQlgWa8Fuizok:I4XUpLQP93a6HXcSaT5GgWSizw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646857600, "uuid": "6156135c-0ecb-4268-b5a0-5d9418af686a", "value": 222720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646857600, "uuid": "45da7b9a-aafb-4ff9-b417-d6c1ea79404d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646857600, "uuid": "8f8e1112-f6a8-46a5-be80-7471c27a91f9", "value": "1ea0ac85d2ce2b68c7303e35df111e51", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31568830-9f96-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646822796, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646822796, "uuid": "4aec6072-5847-4d09-b236-3855a7b0a5e7", "comment": "Malware payload (Heodo)", "value": "787abd74ff40508dd238acf443e42cb5", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646822796, "uuid": "da4163f6-a7ff-484b-85cc-abe1e67137a7", "comment": "Malware payload (Heodo)", "value": "9c3ad0ca7cb1744785a2f4c2d7b5f9eb9e1fc938f3639b19807a716da2a84509", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646822796, "uuid": "658cbdc9-5cfb-4450-93a0-d2541ddbc476", "comment": "Malware payload (Heodo)", "value": "f9f894db34f835d0e983861a25306158fcb727f5", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646822796, "uuid": "5eb38d6e-ae84-46c6-a6d7-6e52cc004dd9", "comment": "Malware payload (Heodo)", "value": "c1407cb9f5f91ed7c992cafeb656068d2d8fb042e54b61777a347210a66a385bbdfd684f3140d79b8cb704555718225d", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646822796, "uuid": "948bedeb-362d-4caa-980a-b644e7c6e057", "value": "T1B7257C107E8A817EC71B85B30836676D6FFEAB204B6CA1CB478175ED2D316C29B36705", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646822796, "uuid": "ca4b2edf-d50d-44de-a392-98b5e25e0285", "value": "087c9809507dfca4c3283e6c7539e91c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646822796, "uuid": "58d558e8-0a14-4151-84d5-56ee340304b4", "value": "12288:cR5SOyRHiA6m0OcEl1zt6JtcS1j2xKkr:cR5SOrKl1zEtcK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646822796, "uuid": "2bdfd480-c1a3-41b9-aec6-aef2c3cdc2b2", "value": 1040384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646822796, "uuid": "cf38d9c4-6b2f-4c76-ab21-e4a2779eb2df", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646822796, "uuid": "6ded57ab-719e-4aff-8097-afdb86aab5a7", "value": "emotet_exe_e5_9c3ad0ca7cb1744785a2f4c2d7b5f9eb9e1fc938f3639b19807a716da2a84509_2022-03-09__104630.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8c30e55-9fbb-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646838995, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646838995, "uuid": "8db0d9cb-b5ed-4a1f-b87f-44bc2e65ed15", "comment": "Malware payload", "value": "ee1c339039894ebea3a0ac90d03579b0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646838995, "uuid": "0b1ebf44-5c9b-4a17-90eb-503526d6b93e", "comment": "Malware payload", "value": "9cceb2d4de4f97e7bb261a9550cfbe224e43247a3a0d31faeac85e78616d0e5b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646838995, "uuid": "630477e7-8377-477f-b7ea-62f01cfe3b7a", "comment": "Malware payload", "value": "d08072a61178284256beaecee5385b20c04dc244", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646838995, "uuid": "f9d6611f-a772-4abd-b2e5-f6884005c9d3", "comment": "Malware payload", "value": "28d75f5f73fd6e42ac94b34b9c59cb5626d96065096147ccd7a809da5600371021dc86bfa90f804ef70ddd2cdd517902", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646838995, "uuid": "7be8290b-ab58-40cb-9ded-e0f8bd785164", "value": "T17A642311C5A31CA5FAB69C7C181E7C3BE36C62A15F4FB9C95BE330191F7B9209974888", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646838995, "uuid": "75f8a933-2aae-4a05-a4a0-7644e50f6f55", "value": "6144:LKUgzcqBk2cKkQQ9oDqBPzl+1wy+lt6r6XI0Wp8Q3UqYD:LK7BulvaDqNZnyWt6ewUqQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646838995, "uuid": "73d078e9-5945-4910-a284-e61dbd019f3e", "value": 319745, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646838995, "uuid": "ef1dcde7-1ca1-40ac-9be5-0e50b0f50417", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646838995, "uuid": "1b5aed29-e2b1-4563-a652-5a218c8550d8", "value": "ee1c339039894ebea3a0ac90d03579b0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c0dc995-9fb3-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1646835189, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646835189, "uuid": "aa4ade2f-6583-452a-9f28-856f8c4a05f7", "comment": "Malware payload (AgentTesla)", "value": "04995eeae0007aa72285afecb062dcf1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646835189, "uuid": "9c1e3257-b8c9-43ee-8766-60cba9c4f786", "comment": "Malware payload (AgentTesla)", "value": "9d8fe026c3bf42d48ebfa3738d264bccf9b116819cdf1eba41ccad7e19f112c2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646835189, "uuid": "8fed19b6-fe1c-47e5-8c6e-06ab15ce5864", "comment": "Malware payload (AgentTesla)", "value": "217c8d24ffdab07caeaf4fc222fd952738b05ce5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646835189, "uuid": "c7480639-bfc3-47d6-a429-77f7c9f83ba8", "comment": "Malware payload (AgentTesla)", "value": "5f5bd34cde8019d90c962b35d390166ee4889972f2dd4907a5a9c0dfe32248c820066d717678883eaa08e3deee52d2e6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646835189, "uuid": "e3d8e267-1316-4786-86f9-be169a0b5137", "value": "T1690533761C5ADE86B4A3424A6C38EFF77E0FD600AB56C44A12B94D37851C4B2CF1B2C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646835189, "uuid": "f2e47c58-df60-4123-a632-f4a1fab98654", "value": "24576:ahkt/2lgg2cin3kMCSgbbTC+KKzX33A0XxqVTxMO:6Qg2X0SqbTC+Kw3AoxqVqO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646835189, "uuid": "c948f4d8-20a5-4f80-be23-16f54e1cbd3a", "value": 861851, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646835189, "uuid": "3daba4d7-157c-4d48-a35a-0e7745821be6", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646835189, "uuid": "708f84a5-d193-4816-8116-9582ae291bdd", "value": "AWB. NO.1603915025.exe.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6b33b1f-9fc1-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1646841515, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646841515, "uuid": "b21bebe1-d43c-4b0d-a73c-7e3b28f24a30", "comment": "Malware payload (Mirai)", "value": "fdbe69dd2f02501a2fb5668d9e52d9ec", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646841515, "uuid": "b5b75d69-dfee-44db-8e90-bc29fbd3a870", "comment": "Malware payload (Mirai)", "value": "9e703a72183168210ff6bbcd0f7808affe06f770d7ab6f3c647dd20ea5c62b24", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646841515, "uuid": "41fa8883-3472-42a8-80b2-955b7a700cf5", "comment": "Malware payload (Mirai)", "value": "ea99753b9492ed9530cdedf925d2093a52d8d9da", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646841515, "uuid": "5a1d1c01-24a9-449e-8ff3-8adeb1043046", "comment": "Malware payload (Mirai)", "value": "4862b5bdebf9584b18277520c60a1bd3db379120c54169d4080d16ca492bad02e5f967a59e1427bffa5f1a7752044aee", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646841515, "uuid": "0d9bcfce-a57b-4402-89d5-c0a65a96d6c9", "value": "T118535CD7B404EE3CF94BE7BA80114A09F922732154A30F27A27BFE936C721659C57C86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646841515, "uuid": "59e29a45-3bf2-4fcd-9b77-92c7e19ddac9", "value": "1536:fLOnAbrJq9KtC4ZAwUJFQNuvrYkG6nBvHV9Uhs1Rib0NmnldxcVb4A+8+:SKtdZ4QNuvrYkG6nBvHV9UqKbE6kbXu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646841515, "uuid": "8a306dec-dd3d-492b-bdf6-5f9fb9d260cc", "value": 60672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646841515, "uuid": "84974d24-7a58-4625-88dd-c9725b97ddd4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646841515, "uuid": "34367312-6536-43ae-a70b-6ed4b0250e6f", "value": "fdbe69dd2f02501a2fb5668d9e52d9ec", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81bda8ce-9f9d-11ec-9275-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1646825937, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646825937, "uuid": "8e4f6e61-3b25-4689-9fad-77ef88f97fa8", "comment": "Malware payload (SnakeKeylogger)", "value": "1a7548ae7ca26e31d439a246e8961c1c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646825937, "uuid": "aafb69f0-2f2e-414c-a29f-bb9ef2b4d34b", "comment": "Malware payload (SnakeKeylogger)", "value": "a07cbbd2eb1a433275f36b62b5f850aebe498091e1926c59a02c54d5bf0b4863", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646825937, "uuid": "c6c406f5-f6ce-491e-8650-12add20b9f4a", "comment": "Malware payload (SnakeKeylogger)", "value": "8cf378b6f179d86fecc7b901ac5dc13c42f1243a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646825937, "uuid": "b2d18600-fa56-4092-bbbe-6192332bc1f0", "comment": "Malware payload (SnakeKeylogger)", "value": "e89c88047144829a4b597306719efc44cfb0421ba982b56a0916647f261e0d204061c04bb98ef75b708e6839bc4557c0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646825937, "uuid": "95b7f99a-2681-453c-b40b-549c40e6b104", "value": "T19BB45A86B6EB6812CD1635B0F2324971E1A0FDB14F58C932656C7E09B7F91ADC532F28", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646825937, "uuid": "40e83b77-c330-43e1-9dc4-cb9ba387fa32", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646825937, "uuid": "c3209648-7cf4-49cf-b3de-1480f7b40521", "value": "6144:2Gi9IsFru9rKf8CY4n1uErmunZnZaSDorfDZi85PjiwS8Hd8swxon85Ol7p9:ZsFrEtY133aLDZJ5Hbq485wn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646825937, "uuid": "77cf6666-7188-47fa-b48c-0066a9acf924", "value": 542277, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646825937, "uuid": "616edf51-356b-41be-ab3b-a6bc84ccd1dd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646825937, "uuid": "9f87f99b-f66d-44d2-9274-c2dd0e335d89", "value": "cali_crypted.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da9fdfaa-9f8a-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1646817926, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646817926, "uuid": "ccf95dc9-a501-47a7-bda0-e0f1700bac52", "comment": "Malware payload (AgentTesla)", "value": "5eca706fa74acfbcaf2b2129a77992f2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646817926, "uuid": "4ede9105-1295-472b-8898-2e86c0ca5c67", "comment": "Malware payload (AgentTesla)", "value": "a0d4e6caf3d71bc26235ed197e33b273fc4e52f6d9f7c2ecf6f4572b32c6a2fe", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646817926, "uuid": "dfa05a01-ec93-4e8a-91f8-0fa33be0c9e5", "comment": "Malware payload (AgentTesla)", "value": "65f3d689004620753f5204be0fb968849344534d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646817926, "uuid": "048350f4-50d3-4817-bf07-ab1069bc3892", "comment": "Malware payload (AgentTesla)", "value": "df75e3a2cb0e83e359eb2e87bc22de53112994e6abac90904d2c17baae5b7f3ed392ab97c2bd522deabd39725f2d4662", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646817926, "uuid": "f0d389aa-312e-4be2-b4b5-1c5085929cb1", "value": "T17035AEE229FF501DF337ABB16FC8F8CE986AFA63161A20D711521B768423980DD61735", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646817926, "uuid": "cc131180-7f44-4f02-89f0-54f0ec3bda85", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646817926, "uuid": "2d185685-d5e3-4aed-aca7-4b5fb74026d0", "value": "24576:FD5kU60s+goE4pwp3XT93xjcfNJvpiOPtA:FD5kEv84p29pcfbBPV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646817926, "uuid": "39911e71-cb73-484b-a10e-6c5c16602cbe", "value": 1113600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646817926, "uuid": "2a350ff8-35e4-4481-9c83-07820fe718e6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646817926, "uuid": "55529b18-e203-43c8-900f-26ac233ecd60", "value": "Payment copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6a2682e-9f79-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1646810645, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646810645, "uuid": "7d061cbd-9e51-47f0-a72b-636e51d058c6", "comment": "Malware payload (Formbook)", "value": "644f4f43e840fa6841050bfd9ee481f4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646810645, "uuid": "011d3117-b908-437d-8642-c7d9917c63b8", "comment": "Malware payload (Formbook)", "value": "a10514b9a622369f9e922896ec542e856068d2a4a10bc8808436bfd88a2e44f2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646810645, "uuid": "942b0a5a-9c92-47f2-9870-d1e920cda24b", "comment": "Malware payload (Formbook)", "value": "ee97e94e2595f68a062f2dbc05e649e340ac9f14", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646810645, "uuid": "f6ac967e-7a40-426b-a85a-86d13669d693", "comment": "Malware payload (Formbook)", "value": "ebcde8d7e880c2aa491b5456abf0629405ae8a9a65df49996fe3002a9ecfc13d11d4c8b119fcf70abfbe95765dfa9554", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646810645, "uuid": "cf129191-38aa-4f0a-8350-076661d298a2", "value": "T13AF4C69C312431DEC96BE6759AA81D68FF903C7B831F511B902731AD9A3C987DF244B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646810645, "uuid": "4f2d8190-8b51-4a91-9095-3075f3a76a41", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646810645, "uuid": "960f03e5-5e30-4c8a-9947-7425e1e31a3d", "value": "12288:4tTcqhQJZXvzWXGfr6rzJtn2WWT3MbjJTCtbetQBOPpGXG0WGUjHFYKIkEH/eMEG:4GUQZX7Xfr4tZGMbtTCtbDU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646810645, "uuid": "8eff9ad3-74de-4456-80fb-077402e8ad12", "value": 749568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646810645, "uuid": "48bbac32-5615-48a1-a20e-551025d72f31", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646810645, "uuid": "3b47793a-337c-45e3-a637-36a1142dd448", "value": "INQUIRY.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df8bc711-9fb8-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1646837691, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646837691, "uuid": "8d1683cd-3aef-4518-95fd-275001038cdc", "comment": "Malware payload (AgentTesla)", "value": "fdd6359b2b7f66571882b871dc3dc4a0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646837691, "uuid": "09412c57-776f-4781-b932-7a6dcb8e2def", "comment": "Malware payload (AgentTesla)", "value": "a18f1eb5a6dfedb0c3ce7c7f4243aa1c88f1f5fd193c1a7a84023a0e77b1030f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646837691, "uuid": "4983bf65-b744-47cd-b924-b24ae03a87c6", "comment": "Malware payload (AgentTesla)", "value": "4c64b7efc75bc4f774ab79186a58b47c36f7b32d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646837691, "uuid": "bd909ea2-fad5-49ad-9d31-e5082a412a28", "comment": "Malware payload (AgentTesla)", "value": "f969a5384b469d1780231a5aecbad3b86c160376a3552c178c7a792ea4b2250c92dce26a22da29a98bd70ecca4056ea9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646837691, "uuid": "6ed15fc1-7445-431e-b401-844eb66a004d", "value": "T1E0B21BC86AA4816BC6F50A38585E8170F364ED33AD255B372475330F6BF26C48EE19B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646837691, "uuid": "d01519df-e065-422e-8849-89f7bd3c60bc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646837691, "uuid": "5ef088ac-2c1a-4e24-9e19-e11edd23980a", "value": "192:HpJf8HF4q2d0hEEQbdq4zMr4aLH85Svq3TKkJxAMMD2tqjWzG09Rcf:Hk5K0SEQbdq4zMkY8oviTRJu2tBzGcO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646837691, "uuid": "df36b04b-bde2-4496-879c-2b92e7a42347", "value": 24064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646837691, "uuid": "70e0cedb-4fe4-48e4-a15f-7c3b136dd154", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646837691, "uuid": "98647a50-982e-410f-8eca-c1d97debe4d1", "value": "Products Inquiry - 20220309E8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6702cb5c-9fbf-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1646840495, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646840495, "uuid": "e8e273e0-cd38-4be9-962e-d78e0fa54a4e", "comment": "Malware payload (RedLineStealer)", "value": "8ace45e3d1246f7960a88842ae9fd45e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646840495, "uuid": "817533f8-da39-4287-8fdb-520f88547b60", "comment": "Malware payload (RedLineStealer)", "value": "a24880fb0761998edebd4649a3f127f2522dd0b8282c016f1cde70d01aa805c0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646840495, "uuid": "a74ca52b-c767-49c6-8f94-8a79f44622c2", "comment": "Malware payload (RedLineStealer)", "value": "5e51d4365af9c0cfa0ddd8d904e359d291868336", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646840495, "uuid": "b0c57426-0312-4220-a935-71c5c232fe78", "comment": "Malware payload (RedLineStealer)", "value": "c8518a160e46c8cad42a36a9b0869eb3cd35429d3975bd9c024ebcff8c9592b2c2250015a6a28c79a2fb6060a7e44df3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646840495, "uuid": "403166cb-e82a-4307-b3fb-f1f847c97958", "value": "T1FA15BF0099DA503AF52A7AA91BC1BD7749D3B96E1404D0BE2C1CCA894FE077C9DC1FB6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646840495, "uuid": "6cc7036a-4a22-4a80-b237-25534616b1ea", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646840495, "uuid": "34c01db2-5c22-4402-aa75-f2e6c7d91f70", "value": "24576:B0SSfb6NgDS8oe+yOekUQR6pK9Tvhlb0Xk:KIwme+yOeIsKvPQXk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646840495, "uuid": "477cb823-31f6-408e-84d1-6b40b598b1c9", "value": 910848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646840495, "uuid": "09853ca1-da97-45f5-8f7b-792b29020673", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646840495, "uuid": "489bfc2b-1a3a-4ef4-8fdc-82712c46bc4a", "value": "8ace45e3d1246f7960a88842ae9fd45e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e4cd1b0-9fdf-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1646854305, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646854305, "uuid": "841cb6d0-cad8-4c29-82be-cce032648010", "comment": "Malware payload (RedLineStealer)", "value": "68f87ca59ca0d412bd0b4377e2f8167b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646854305, "uuid": "dde65d33-933f-41f6-8d48-0cb0cf1fbfbd", "comment": "Malware payload (RedLineStealer)", "value": "a2556ce4f6a53ac6e63f597e9fe1671bc3d65d6b0b2af5ff3824a890f99cd9aa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646854305, "uuid": "bcf8227c-5ba3-43f8-9c7f-e93f55e41e80", "comment": "Malware payload (RedLineStealer)", "value": "9fb393b1752f70e026a7cfa99fc045f03b3578d6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646854305, "uuid": "18ae8873-f7cf-40ce-a4aa-63ae40faf9d7", "comment": "Malware payload (RedLineStealer)", "value": "c4c68246ca4d72665c63f79c5d0ff1fe43a977265ba2bca43a528b873b9dd53adbe6988527efcb1f52f5d4b4cad365c6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646854305, "uuid": "a95acf8d-745f-4b3e-98db-592b79103191", "value": "T1FD35337B832F5A52C6B6C8B11CAE11C73C8AC49D048A9255ED8CB372DF2D80B75535BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646854305, "uuid": "9ee285c1-0a97-409b-ba4a-cd46bb36049c", "value": "892bcd629d271910036d4dc13277728f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646854305, "uuid": "fd89f36d-8770-43ea-9421-c1e9ac6381a6", "value": "24576:wPD0gfifcZoDSvCls2jDEc4Vtu13n9xQoA0H:wQEif3f9DDB3n9xg0H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646854305, "uuid": "34921e02-d292-4807-b3e9-9f602c4d16cc", "value": 1130048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646854305, "uuid": "51e64b4b-e3c7-4f42-9066-c92348e8b62b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646854305, "uuid": "66ac43bf-8c10-4eb4-91d8-e804a717ffa3", "value": "68f87ca59ca0d412bd0b4377e2f8167b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bdd87b9c-9fb9-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646838064, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646838064, "uuid": "b349e397-37ac-46ae-a566-8aab986302c6", "comment": "Malware payload", "value": "517d2b385b846d6ea13b75b8adceb061", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "hermeticwizard", "colour": "#E5FC1A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646838064, "uuid": "6ec9bbce-0e04-401d-a2a1-920dcac1baa4", "comment": "Malware payload", "value": "a259e9b0acf375a8bef8dbc27a8a1996ee02a56889cba07ef58c49185ab033ec", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "hermeticwizard", "colour": "#E5FC1A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646838064, "uuid": "963013fa-1ef8-45d2-b89b-91ce170c1500", "comment": "Malware payload", "value": "3c54c9a49a8ddca02189fe15fea52fe24f41a86f", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "hermeticwizard", "colour": "#E5FC1A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646838064, "uuid": "6ab67057-32e5-4281-af3e-a840aca5155a", "comment": "Malware payload", "value": "0b6aab8d08f8c65a08b36407001183be8580cca818d7e6662a6cd1e771a7ff3f3d1b38790b18ddb47a182def5a320638", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "hermeticwizard", "colour": "#E5FC1A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646838064, "uuid": "b777f2ad-109d-496b-963a-9d81cc048e63", "value": "T17BE4E02078C0C031C23B243559B5EBA605BDB5711A78D69FE7EC147F1FB81C3A626A9B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646838064, "uuid": "78ed0008-e913-49e9-afae-50bdce637626", "value": "e099d3524b6906cf8460b4e6db0b11f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646838064, "uuid": "c7985dd6-5055-4343-b14a-8bc0fad9ab8e", "value": "12288:J4WCTqjtByJsZrjIYlkytnSg9hcr1DnDH2iRNL5tj1XUNgASK4CTfVf1WZ62PNTr:HGqRBRtnSEhMhDH2iRNL5tj1XUNgASKw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646838064, "uuid": "3f9ed5e2-bfe3-4569-bf7b-72c53a8cb4c8", "value": 698632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646838064, "uuid": "9a387c5c-c328-4b55-ae34-670099c6caff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646838064, "uuid": "4e6be42c-7f70-4f0d-9ad0-3714c6398bcb", "value": "a259e9b0acf375a8bef8dbc27a8a1996ee02a56889cba07ef58c49185ab033ec", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d9507f0-9ff3-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646862679, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646862679, "uuid": "50c03c79-cc06-4e4f-beef-773f83cd038d", "comment": "Malware payload", "value": "44b7eb71d039326ab66b37b2586af3f6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646862679, "uuid": "a85b9095-478e-408f-acd7-f326683f4d5f", "comment": "Malware payload", "value": "a2ab097fc93271dec4da4fd22968ae146c01b16f5968e86e7896e2188e059b5c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646862679, "uuid": "a66b6195-ad52-4e2f-867f-c0f97400f09e", "comment": "Malware payload", "value": "d990a2472f01c67455f9c47cf2e501c82978547a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646862679, "uuid": "686b335f-5424-4076-a814-e94d7c54bef3", "comment": "Malware payload", "value": "f316f52c9ab1f5d66c2504f1e1c2fd6a2803088a20a7798d75f4ba64cb0fdf1457c9c941e2379474ea0e8f406986ef77", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646862679, "uuid": "76c0b18b-b9f5-48e3-a095-bfe46557b0af", "value": "T1CA051205B2F90F56E97967F921B671400BFAA43B9031F72E0DE230EA5A22F548B54F53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646862679, "uuid": "d0c84e8b-7505-4cbd-bdf8-fb4e299e66a4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646862679, "uuid": "045cea8b-78dc-4fbe-b747-aaec805e165a", "value": "12288:faNFVaaKZZfffJbx6R6P0TNR5dYBVk0NR867eZWwzZFfGjF0WCHunXp4zl:faNyDfXuRFzInkgR86+fGjORUXizl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646862679, "uuid": "5e079042-acf5-4cbf-a46f-7040b5d62f17", "value": 816640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646862679, "uuid": "8e98aba3-dacc-4783-a592-a54c2a60e2da", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646862679, "uuid": "3d2b84bf-31f3-4bbb-9c5c-c3bdae3801c5", "value": "SecuriteInfo.com.Trojan.PWS.Siggen3.11918.8590.10807", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "701c946b-9fba-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646838363, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646838363, "uuid": "1125d32f-380f-40b8-a57b-1ad212f52a26", "comment": "Malware payload", "value": "66a419c5f47fb0add8b7996f621988eb", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646838363, "uuid": "a5f1bb61-a395-445d-943e-f0a5e739fdfc", "comment": "Malware payload", "value": "a2e18e25d0cf1c5b3c6315b99e59766279b3be154fc420f8f8f11fb66d0cf7e4", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646838363, "uuid": "1ff01e3f-40e9-44fb-a190-9164f76bbd32", "comment": "Malware payload", "value": "2b72be31c7c07e34ad949ff5a221a09641aae064", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646838363, "uuid": "e9acefee-0b1a-4368-9e29-28eaf2a97881", "comment": "Malware payload", "value": "ea66389bd40daa8b42304dc189712e995961e33eff5d0b6104ce74539d6fd22d569bec16f36d21061af2cfe9729f40c4", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646838363, "uuid": "9e6f7061-bdf9-422f-96d8-cdc1e840c6c0", "value": "T114165A23B284A53EC46B1B3A5937A35C993FBA713926CC5B57F4088C8F365413A3E647", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646838363, "uuid": "e158cf58-cea5-4447-8b8f-f119f606e5b8", "value": "49152:/DKIs0JufBa05POxP+ZuwcncsVQge5KS97+eBgWsTJk4jT98gsySnLLY8EWQ/dOY:WIsHOvLjB2VEWQTp6GYrAR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646838363, "uuid": "1c954b36-6f2c-4eb4-98bd-0e3081f5c996", "value": 4144128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646838363, "uuid": "e54e54e8-51b8-4387-9125-7aaf41ded201", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646838363, "uuid": "d56e17e2-7187-4842-9f72-20b1b4c0827a", "value": "NT.IplaceDanf08032022.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3c3bcb2-9fcf-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646847496, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646847496, "uuid": "e1a886da-e312-405c-aa1f-645eb89d02d8", "comment": "Malware payload", "value": "d0eebdc0c4faf99eb70e87830823fe69", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Expiro", "colour": "#5054CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646847496, "uuid": "b5b2c2c5-ed44-4a67-8254-5be8b10f8468", "comment": "Malware payload", "value": "a34cb910df5d2d3fdc9520e78df9453ba831f4b0d7017e3b96b08e7495796291", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Expiro", "colour": "#5054CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646847496, "uuid": "199c5e90-9eb4-4a74-af2f-4fed1a0f5db8", "comment": "Malware payload", "value": "717c5f2bbbd9c34ed9c98a30bda60b1c5a09700b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Expiro", "colour": "#5054CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646847496, "uuid": "4121f99b-3978-41f8-96a3-69f07d88da82", "comment": "Malware payload", "value": "d97fc33c19cf02028bb0e5127a779fd774aa991416f1e49c2213d55a85b5f65f4ed02030e7c94b984775de293cbb03c1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Expiro", "colour": "#5054CD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646847496, "uuid": "09b85c12-5362-442f-85b3-4a3fc4ebc509", "value": "T12A2523A5778981FBD23B1E70C1D5F12998AB7D6659F011036FA72FED6AB0480873C623", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646847496, "uuid": "947f4e8e-7e9c-4d33-a364-fa67e9e5731f", "value": "a14fe147cbb35ac7afa52e2cceed81b7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646847496, "uuid": "117b379b-3850-434b-94b9-e35b607341a7", "value": "12288:JJfXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:3fsqjnhMgeiCl7G0nehbGZpbD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646847496, "uuid": "3738af53-fe9f-4dff-90bc-966dd80b347c", "value": 1048576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646847496, "uuid": "23ea4639-58e5-48b9-951b-4208a0096320", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646847496, "uuid": "99bc4f06-2917-45e0-a4a2-0d0432bd2f29", "value": "mscorsvw.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fdaceaad-9f71-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1646807247, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646807247, "uuid": "dd40e858-30b9-4847-b602-0e6b3e896adb", "comment": "Malware payload (Formbook)", "value": "344bbe5e0e86adb47e54e3b87601bf2a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646807247, "uuid": "66bbdab4-a42d-4418-a7ae-0817ac20e8ac", "comment": "Malware payload (Formbook)", "value": "a37ef7dac182a6cea6afeb46e114c8ff98a4befa00a3ee353885a354c9d58109", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646807247, "uuid": "be1ede73-1018-4e54-a20a-7951dfcd7827", "comment": "Malware payload (Formbook)", "value": "f350ac874315f23a45605e389b3848dd70c00c46", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646807247, "uuid": "3fcff75e-683d-424d-806e-199e592d8a93", "comment": "Malware payload (Formbook)", "value": "e2070512be36c87369aba5689fe23ed560e932b96ceb6230c174985cc5a8c73bc0928d692d1600e6c39647c15b845dff", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646807247, "uuid": "451c6d16-9ba0-4706-b7f1-f7ef9aaee512", "value": "T1B384D01BB1C265DBC4224D3B0EC1696DB36BEA5DA6CF1A7732613F999B3520ACD01703", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646807247, "uuid": "a621f8c3-d156-4ed1-aacb-28807ed98385", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646807247, "uuid": "addf7300-d86a-4d84-8b1f-db474fc8c11d", "value": "6144:TGiCXvMQvgGUyMXBegK+ZQnRDm8WK6tnVcsJNBaRo/p2gDF10x:mXEQvgGUhcnRDm8UVl/aC/8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646807247, "uuid": "0304028d-fc0b-4f52-bcda-ff3d442f347e", "value": 373693, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646807247, "uuid": "0c330394-4b44-4b48-8ed9-2563fd97338f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646807247, "uuid": "e807760f-bf8c-44b3-96ad-a3c96cc8efec", "value": "SCAN_112877484993940484_jpg.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88337a0c-9fc6-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1646843557, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646843557, "uuid": "c8d55db0-820c-42e4-8ab0-a3812d017377", "comment": "Malware payload (Mirai)", "value": "c44aeb32dff62a857a3a2013a7ea5747", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646843557, "uuid": "87a6faba-d34c-4af2-b689-10f1e8ceb505", "comment": "Malware payload (Mirai)", "value": "a39371b252e7ac05c34ed950352304911e2c97b60993a51d2be0fa86088e77cc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646843557, "uuid": "a23036f2-dfb6-4cdd-a3f7-a3407a897674", "comment": "Malware payload (Mirai)", "value": "e984c8f77e08f2c1a04370c336af9b130b87c6e5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646843557, "uuid": "00e41546-1b04-4f54-a0b6-f736ac53d7a4", "comment": "Malware payload (Mirai)", "value": "7bc16a5ef8642284864dc792804ed7da6ac4c2bfb2be38cc2c6ee90d6c59f266113fb67c341540a41ad16f8733a0edeb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646843557, "uuid": "7642d05f-e077-4136-b7a8-ecdb3a0848bc", "value": "T1EA533A22A9792E13C0E5F57B62F78324B1F6174E24A88B6E7C320E8EFF1455065176B2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646843557, "uuid": "66399367-80d6-4800-8af6-392d738597a1", "value": "768:L7dOiioLq9HCAIlv4ygCrk9u/RQ3XCt7kq4PapxuF6O2O+hAAzjeFAN:vdOii+SHCAs45kk9uCSt7kqYUhAe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646843557, "uuid": "ac7102bd-cd58-4a96-bb74-f73aa4bc36ec", "value": 62500, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646843557, "uuid": "4758a274-a97b-48f3-ac84-c72bd3670c19", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646843557, "uuid": "13719196-dd42-43a7-aedd-b9ea181ef63e", "value": "c44aeb32dff62a857a3a2013a7ea5747", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6cc10adc-9f3c-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646784241, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646784241, "uuid": "b6ffddcf-0b55-4d69-aa1e-c5c89221e5dd", "comment": "Malware payload (Heodo)", "value": "2e2d337244fb5307c6a0eb5a71a805b7", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646784241, "uuid": "d822557d-737b-4a9a-b968-146578b28ee6", "comment": "Malware payload (Heodo)", "value": "a496389d1ab18cfec82e11416a7a7154f7fe73662c7acd367b8f939ab5ba599d", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646784241, "uuid": "c9cacc21-c33e-4853-a96b-052f166186f7", "comment": "Malware payload (Heodo)", "value": "9271425d844520a16b5140a0fd27bcc6eb1160cc", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646784241, "uuid": "d7a58d5c-947b-4325-b3f2-3744d1bad504", "comment": "Malware payload (Heodo)", "value": "3a1106e4651c78111c07c15552c6a9dcd7bf13faaccd7f8b397f23f7497737d4959f9936c7d36378dedba5cc5c36fd91", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646784241, "uuid": "1084a801-123b-4ed5-ac70-61e1ce04f23d", "value": "T196B44C22E151E0B4C21744360607737DE60FADF01B95B277A3B015AFBAB5E71EE26326", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646784241, "uuid": "86962785-ba3f-4d36-9d18-fd7cc7186778", "value": "c354d2e1bcc359dcb00a22865c038d4a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646784241, "uuid": "e455de3a-b757-4053-81ec-853ad962517d", "value": "6144:TMhEi6lq1EvTzbQJqnoibRcJQfTfJZsIhzED5TJycXo3ZqdK/J:hFGibRYQr1koko3od", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646784241, "uuid": "03a6f17d-78c1-4525-8355-5b9dd92cdad5", "value": 507904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646784241, "uuid": "b7056780-07b9-4690-83d8-00244b465622", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646784241, "uuid": "d6b70fda-df9b-4bd4-893d-b9bd5a774078", "value": "emotet_exe_e5_a496389d1ab18cfec82e11416a7a7154f7fe73662c7acd367b8f939ab5ba599d_2022-03-09__000356.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e32c420c-9fc8-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1646844569, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646844569, "uuid": "1308dc82-694c-4b48-807e-f8abc117ee62", "comment": "Malware payload (AgentTesla)", "value": "c8a496850aa393933ad91edd92aa517d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646844569, "uuid": "c64beb89-7901-4586-aa26-3227dc71e042", "comment": "Malware payload (AgentTesla)", "value": "a4d102851527847cdbf52d7c8cd316dfdd364004578099acabd4ec1c3bb71e19", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646844569, "uuid": "7ecff3e6-a541-4287-ba68-971451f0c8f2", "comment": "Malware payload (AgentTesla)", "value": "95e8dc9c1f6463cb1d5d2eca4ae79d0934eacff7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646844569, "uuid": "da0ba90f-f6e3-4c0d-b575-87cc9f9f5811", "comment": "Malware payload (AgentTesla)", "value": "2e636d8c43cb31613884b30f57df15b8080ad08e20c89e066058ef51ae426bad79ef20bb6ffddd9460c9922f2ee78288", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646844569, "uuid": "59bc6cbb-fd83-41e2-ac9f-dbc43374528b", "value": "T1CC35E01517488193CAA95B79D443B048867CADDB45B0FF888DE0EDFE647BBD4BA2301B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646844569, "uuid": "6034b442-fe44-460f-9a20-d9f924fd5d26", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646844569, "uuid": "5827b28a-d721-4b4b-98d9-d62dd00cf4f1", "value": "24576:SlZ8o6Qejh1Wsr8Dv7efme7y+gRp8d25kg:SlZ8wMc57efjy+wm2q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646844569, "uuid": "ca686b5d-d873-47e8-a60a-09ebd89a4a39", "value": 1126400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646844569, "uuid": "0f356f48-b198-4c8d-a0cb-6cc58fb26e23", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646844569, "uuid": "d1316099-4a03-4c0a-a76e-3e73cd267f48", "value": "c8a496850aa393933ad91edd92aa517d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "869bc35c-9f9d-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1646825945, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646825945, "uuid": "417fa55f-e59b-4f67-850f-03f0f4b058b9", "comment": "Malware payload (Loki)", "value": "059020f2f718e24af85f325d73cee1da", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646825945, "uuid": "1ee806c2-e6df-4a4e-ad8a-249002117608", "comment": "Malware payload (Loki)", "value": "a4d6273f3d48041687b35b6fdaea2870c980cf6def1f9ebf90cb99ec034fc97e", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646825945, "uuid": "c7f77c2e-b0a7-400c-9fa7-6fe1c5f6b992", "comment": "Malware payload (Loki)", "value": "2d9a600b1a2bdb582cd8fb9d260bf4cbb63a43d4", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646825945, "uuid": "e292396c-4caf-4136-8ac6-07e1d9ad4c86", "comment": "Malware payload (Loki)", "value": "ad4fcf5dfcf2c7587c25a570032a1dfa2cc5122d8e90530e142ed0365f49fc4bb5cf3d324d1b7fcb139242bd3a7d8b94", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646825945, "uuid": "ff415f73-d83e-444a-9d94-c06327f5a9a2", "value": "T1DB1412743191A0E4D1BACA78FC1D8919E67BBC1ACF90B0BA51ED705EAD72E583313470", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646825945, "uuid": "c91dabcd-9740-49f5-a7aa-5d85b1c10fe1", "value": "3072:71aaQA0j0y99GJxZLzucQDrSWMeuB5qXwSfM6EoXwJj9yiYKI9q8fJHo:ZaaQA019SZkWHeuBwX1fM6rgCf5o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646825945, "uuid": "6da81884-9a6c-4377-b7b6-1ebb590bb116", "value": 191272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646825945, "uuid": "6b37e088-4340-4889-95e1-00ad2376a116", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646825945, "uuid": "a4f116ab-6c5e-4f7b-ba9b-9742489eb55c", "value": "New order.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5fe8675-9fbb-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646838990, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646838990, "uuid": "78c5a3fa-4795-4e05-b080-f7406400a9b5", "comment": "Malware payload", "value": "0c99131640720d53cab03a4b0b91f551", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646838990, "uuid": "0f196bc2-c488-40b1-b9da-44638ea9191b", "comment": "Malware payload", "value": "a4d68e9dac3cabe01fea8b8467fa0ace09cfa3a4745315cf9328c6c6827bcbae", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646838990, "uuid": "e259efde-3ec2-4ed9-b838-09b7a520f7ec", "comment": "Malware payload", "value": "70092cca721b0fb556873061ccc474c2ca88f253", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646838990, "uuid": "3ab8107a-666b-4ded-a9b4-8b4fd404e061", "comment": "Malware payload", "value": "7c8f58ed11be065d13fae701daac8eedb1f9a547db00e14b885b2b372e87b9b1812fdf05107f7274e2c9016f173435ab", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646838990, "uuid": "e4ffe7ea-eece-4574-9aee-23297f785461", "value": "T1F5163383D0FFD964E38B1EB27305F657C9C8E92826D981D534AB3B1C9815EA5023E64F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646838990, "uuid": "8fed44a7-095e-474d-ad44-bada5332326d", "value": "e41c25ab7824b3df73334188c40518ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646838990, "uuid": "9303d741-7b60-402a-b469-fa7bef46329d", "value": "98304:ESob1d7BT+d1Nk5Bq6nvPZOagRZzRRJew:gxd7IrNkuIx+zV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646838990, "uuid": "3d907d35-dbfd-4012-bb90-b8857682b925", "value": 4046170, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646838990, "uuid": "386f7af5-9fb6-4967-813f-c57367fa3cd5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646838990, "uuid": "b1717e9e-9ca5-47a6-99c3-f9a70f16c1a7", "value": "0c99131640720d53cab03a4b0b91f551.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "592d9ae4-9fc4-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1646842620, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646842620, "uuid": "bbb0188d-324c-45a0-a8a0-3ecaa1913c59", "comment": "Malware payload (Mirai)", "value": "6584491e16ec0989e4374be2acabe82e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646842620, "uuid": "aaf24a78-4994-42e7-b23d-6c6726695ca5", "comment": "Malware payload (Mirai)", "value": "a4e96a54d4b57260be9fa5c3814bc56a3b86801fb82eb1da2105ca924fba75a4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646842620, "uuid": "6447efd6-c891-4985-a23f-be2eca3965eb", "comment": "Malware payload (Mirai)", "value": "bee6e8dfc4ccf751260ca4c7e591337a7031d9ce", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646842620, "uuid": "5799c8f4-3f7e-4f76-acfb-38e8d979c1cb", "comment": "Malware payload (Mirai)", "value": "29a15def6b9bd4ef4885742f0d9c650b7de26214548dbbf3f95601b0bb035bbedfc5a7ccb71286076d9cb7c04e7ea76e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646842620, "uuid": "4655433d-552f-46f9-801d-9ef1bf502274", "value": "T10AD2D17E6A4648A7F070797203C6074A3CA9CFA7B5414C4EF6A3C1B3B8152E72196999", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646842620, "uuid": "80b00a59-501a-4747-8b23-867fb7a091c7", "value": "768:eMHgxzFb+GgHkA1HzVN5zk0XCmxTqnwTKz5as60PAb2JgGlzDpuWg:jgUzVbzkICWT5TKzcn0YbiVEWg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646842620, "uuid": "4dea9009-83ba-4266-88c2-1f9d1e23bbba", "value": 30204, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646842620, "uuid": "3170611d-fe4e-464c-87e7-5d2693e9e830", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646842620, "uuid": "a9e50dc6-6b2a-4a26-8766-99448e8ca0bc", "value": "6584491e16ec0989e4374be2acabe82e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f55922c-9f92-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1646821128, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646821128, "uuid": "59dc0548-c519-4029-9401-f39e867ade9f", "comment": "Malware payload (AgentTesla)", "value": "828b92e720da46cc3f4aef251c0b590f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646821128, "uuid": "35e421b7-1bd3-4774-a703-6b18ef86774a", "comment": "Malware payload (AgentTesla)", "value": "a5010a9bf89afd01b276dff22cc0cd4dc511e84bd66966a0ba0cd7e42d904cfb", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646821128, "uuid": "d5cf1583-447c-4173-a816-5af75097939a", "comment": "Malware payload (AgentTesla)", "value": "00fad933c29c161ca8c19c51931de9d5c52bc0b6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646821128, "uuid": "a5551178-c32f-4b29-a3ca-21f0d3e31b35", "comment": "Malware payload (AgentTesla)", "value": "c8379a1d170775fdec208acef200544347ac457fcb9405bf66a6a22174ad098ee44881e1455c06308b34dd4893d47595", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646821128, "uuid": "d668aa2e-8bea-496b-b160-8f4afb567d53", "value": "T19FF423D59F2807A9FBF4E75004C53AC84DEEAE1AF024D514261BB5E2D932F0BEC266D1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646821128, "uuid": "91e8ea1c-2d07-488f-9faa-5a0b3ab08410", "value": "12288:5zGr7xn9BA6QbR70xHqj6iSJEcd4ppIqKxyZ6LRco/ueE2N7/mOhdJ62C8gzE:YN7A6Qb1KHQS9sWqKYkNh1PNycdngY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646821128, "uuid": "b39f29ea-9584-4a54-a7f2-4aee4bd43602", "value": 751629, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646821128, "uuid": "07b402c7-02d5-4db7-8fe7-57b7fefc3310", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646821128, "uuid": "f6c55004-f4f5-47d7-8585-2ff95f40be9d", "value": "SHIPPING ADVICE DOCS#202203.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef8728e5-9fa0-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1646827410, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646827410, "uuid": "440d5267-1bdb-41ef-890a-18a52bac9070", "comment": "Malware payload (AgentTesla)", "value": "9207da527fd4c36afc6276366285daf3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646827410, "uuid": "c984a200-3505-4e1a-b871-b8d82c7c885e", "comment": "Malware payload (AgentTesla)", "value": "a5f4bdd8fc0f5cc371a28b993c9ff3486347295a902efe33732e9d846b91057f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646827410, "uuid": "2e9129f7-d058-406b-8c6c-9440861ca367", "comment": "Malware payload (AgentTesla)", "value": "b9cc1576484fc1927a9f8c0779ced93c4cdcf48c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646827410, "uuid": "a74d13a7-17d6-48e2-9ad2-35c8bf0efd2a", "comment": "Malware payload (AgentTesla)", "value": "724e625f001f34248a2ff7745e8e1dbc8d79d9e00fe1d7b9f3ece11bf9186c85911b0075ea38861368fec99241ff56b5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646827410, "uuid": "68feed22-7f2a-4cf2-8736-eef8caa5fdfc", "value": "T1DC35BFE229EF501DF377ABB12FC8F8CE996AEA73161A70DB10521B368423940DD61735", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646827410, "uuid": "7270b446-1cf1-42a4-ba27-68f6fbaa53dc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646827410, "uuid": "1d5dba51-a252-43ce-b691-79c2254a19f7", "value": "24576:YD5kWryhPfs143WWvaA/pQWmneTyMi0yJ+LVjz:YD5kW0f04zhJHL5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646827410, "uuid": "501d6f5d-5c7e-4b0d-94c2-9911413cbe27", "value": 1121280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646827410, "uuid": "2772b254-147c-44eb-88e5-0429b71a55ec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646827410, "uuid": "c1293075-918f-4bd0-a9ac-0028e32ccf95", "value": "Invoice confirmation.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "903d8b13-9fb7-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1646837128, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646837128, "uuid": "c34a3fc5-9a81-4877-8b01-3f2254ec5417", "comment": "Malware payload (AgentTesla)", "value": "ceeaa82ca82ab48c00c57c71fd654a0f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646837128, "uuid": "107fc244-ead5-433c-8e9e-7264691ff140", "comment": "Malware payload (AgentTesla)", "value": "a633aedce4321d1e5459c063770b0e0f6c402d97b94655a1def1f01f88d1d8e3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646837128, "uuid": "a08a7b94-422e-43a5-a601-5a4c3b782644", "comment": "Malware payload (AgentTesla)", "value": "09dfe8f8992435f2ef92e14e638eaae7118ccfea", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646837128, "uuid": "2229ab5e-3b1b-4910-94ca-dc477948d2f3", "comment": "Malware payload (AgentTesla)", "value": "40721ddbff44d37232d29d80d0b684a9732b39214d0edbfb22acdf99a25a475156b95aa822fb4d045b7f6f883848ebcb", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646837128, "uuid": "59773f40-307d-495a-9be0-4328067cdcec", "value": "T135B4235C2433089ED811CFF275C66E592BABAB114D6BEC00E3E8C8DA5F7C305D5596CA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646837128, "uuid": "586dbc27-1fae-49d7-b333-b36b983d8822", "value": "12288:Zw6zQODlV0yWzn+TimnijNfRcHVClzdXhrI+k+6:G6cYV0yWzn+5ni5jlzdXat", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646837128, "uuid": "3bf2ba67-1c68-4b28-a6ac-6790f3fd2b47", "value": 503533, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646837128, "uuid": "9326551a-953c-4232-a738-fc12c5a7fa00", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646837128, "uuid": "93ac9895-6cff-4018-8632-ce64bbb14b41", "value": "SOA.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27e31d67-9fbf-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646840389, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646840389, "uuid": "59cea29f-907d-4c4c-a7bd-831ccd2efea1", "comment": "Malware payload", "value": "283714184de56fa765561bc997322078", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646840389, "uuid": "450fd3ec-e534-47ec-b924-0eaa2f759774", "comment": "Malware payload", "value": "a6408aa3a18d3342703cbcc0583366905a4c4480dca3f2701f63920ef070275d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646840389, "uuid": "945b3180-1ab8-4c68-9350-ff19373b9b87", "comment": "Malware payload", "value": "f1f6958c71f2f59ce2e4922cf40634fe9c56ba28", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646840389, "uuid": "09df462c-1872-434f-9444-32d2a32ab743", "comment": "Malware payload", "value": "71a2f1319a2f781bacc2ca87c6839539fa823fe347010783278a34daef12c101525ad8f8371eaf484b62e03c9e6604d7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646840389, "uuid": "027c0155-8b7c-4a38-bdd6-38119a8cd22d", "value": "T17F03F10EA6534078DAA54DBD52B733602CB80AB82293C44B7A06E5F35F971146D6BBF0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646840389, "uuid": "ca727977-756f-4474-9678-ad515a1ce8bf", "value": "768:0IZRqeFhq59wVJxryD+/vzY5DoCzhoj2m/t1WzQ4vFRgZur3JgGlzDpUYsx:0I3XFhqnwHlu+0rMWzQeg4ZVqYW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646840389, "uuid": "f4244e12-65ca-464d-b29f-895ca334aba6", "value": 38216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646840389, "uuid": "3b796dc9-31c4-4f89-95ba-e6c70bf76a69", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646840389, "uuid": "af1435b7-0756-4504-91c0-476ff63d1f57", "value": "283714184de56fa765561bc997322078", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb3e756f-9fad-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1646832932, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646832932, "uuid": "f63de7cc-f182-468a-9b38-e7b934a44e1c", "comment": "Malware payload (AgentTesla)", "value": "8bc20db1ff8dad7180606a0f1ab6b49d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646832932, "uuid": "5277f34b-47da-41a9-8d5f-04eaa9beffe8", "comment": "Malware payload (AgentTesla)", "value": "a68c980d3bd6f665a27a68eaf269af6a8acd6d2d8722bfead7aed109a5c21ff8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646832932, "uuid": "f34f1b65-4d79-42f4-8540-cab4fdfad840", "comment": "Malware payload (AgentTesla)", "value": "3176135098865b974c6b1be1725b69768843923d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646832932, "uuid": "704dfbec-b174-4158-a7be-82b0b22e3127", "comment": "Malware payload (AgentTesla)", "value": "398bd962953c02342b35fbaa2f91ba2b83f1c3bd4f0552712037d78f8cbb4ed8c4222ce7ac49f816755ac2faa62b1ec8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646832932, "uuid": "f195160e-902b-4930-96e4-270c6b8d7309", "value": "T13C35AFE229EF501DF337ABB12FC8F8CE996AE973161A30DB11511B768523A80DD61731", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646832932, "uuid": "845405e0-1497-4c35-bbe1-f21909fd9e8a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646832932, "uuid": "21188570-fa21-40b1-b9d2-a8a9697b31e1", "value": "24576:bVD5krsq0vXU7Eh2vTJT4AycJxD5I1YQi+fQf9TRew9:ZD5krsPvXgEWTzzxD2PfQf91", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646832932, "uuid": "e14d0d7f-a490-4f7b-bdb4-7be1c6eb2ff2", "value": 1067520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646832932, "uuid": "7e8c3a2f-0863-4771-bc81-7a41c0e4ee30", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646832932, "uuid": "e58e0b3f-c7a6-4067-a7d0-788c727801a9", "value": "Invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c260e3d-9fbf-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1646840423, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646840423, "uuid": "56786ad2-35d4-4ab1-a998-3682c14f219c", "comment": "Malware payload (Mirai)", "value": "d50b691e7450aa420c3f372e9e282eb8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646840423, "uuid": "ddc4d0b5-8202-492b-981d-c253b4d5dd95", "comment": "Malware payload (Mirai)", "value": "a7c4049868a948c08074241de7c08ea758fb6ff6828e9a052a801b0cd8507670", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646840423, "uuid": "1d6fdd11-6bd6-43bb-8997-ca810dd0e65c", "comment": "Malware payload (Mirai)", "value": "5785fcdd7520f5c247a2cfd23424a5d37c2ae96a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646840423, "uuid": "5f4a56d1-eb7a-4222-9543-384083c2c1e4", "comment": "Malware payload (Mirai)", "value": "7f35e8712c0ad4270e0801187a4597aaa3335b11c20aa11102121c06f577ef9c9a12767e70a963c91516ae99a563d21c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646840423, "uuid": "e527197f-1a12-41c5-9894-7e8833d0ef48", "value": "T1243318D6B401AEBCF95BDFBE80124909FA71620251930B3B737BFD936C322A58D52D46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646840423, "uuid": "b8307d98-5fae-4e70-acf2-9b8969b90eaf", "value": "1536:YutWMN1Xt/lsFGaVVjLHHCH/nmiPKVS5TdX8L:Y0XlOGEHHAfES5pA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646840423, "uuid": "477362de-041a-4270-a9c2-f6351d0841e1", "value": 52504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646840423, "uuid": "4d639a38-479c-4a58-8404-de4d44443443", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646840423, "uuid": "8e1d86f1-d9e6-4cb8-8c5b-d51f8eadee2d", "value": "d50b691e7450aa420c3f372e9e282eb8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1af1ae80-9fcc-11ec-9275-42010a9c0029", "comment": "Malware payload (Quakbot)", "timestamp": 1646845951, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646845951, "uuid": "438108fe-a2d2-4b82-b38d-2fc95dc2679c", "comment": "Malware payload (Quakbot)", "value": "63d8ab9a1d3fda09a0f9374fc344c400", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama164", "colour": "#6C68A0", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646845951, "uuid": "1d2582bf-6161-411e-8789-f736e3be4482", "comment": "Malware payload (Quakbot)", "value": "a8a1e59e5bb04ac6e7c422a105a6816bc0e1c6755b7902bc670d1cf2bcbeca53", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama164", "colour": "#6C68A0", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646845951, "uuid": "18ad0d26-76a4-4e4d-9c7a-242752cada43", "comment": "Malware payload (Quakbot)", "value": "31532e49f247eacfd9e6a36f691323c17f321062", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama164", "colour": "#6C68A0", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646845951, "uuid": "d44ae239-62d4-4e02-b96a-ad767c5febbb", "comment": "Malware payload (Quakbot)", "value": "95d6a96bcccb72d7e6c3e62ce9717ceb44dff4ed1d60a24c8610f96793faded15352f1b8ac495cc478e4adb3e7957f28", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama164", "colour": "#6C68A0", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646845951, "uuid": "dcfa6d83-7c00-486e-99ae-441c95a8ce4a", "value": "T1CA657E23F2C1887AD4761A3C9D1B739998BA79112D28F4C77AD44E8C1F37A433666393", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646845951, "uuid": "db54e5d9-b277-4d9c-9144-4c10a87d616d", "value": "cf78a88c4b0403a976a85038ec51a351", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646845951, "uuid": "b08820a4-1c83-4f99-b861-71fd8437c943", "value": "24576:LP2GXxd5hyXOZk/R8SoMbEYN54UUrW/tRJfJqOIU2SAHl4XoWSIgX4T:Lu8jI6kcYN9RqiKKgX4T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646845951, "uuid": "b0ac88f2-b2c6-4c8b-a591-19c3ac666b87", "value": 1502720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646845951, "uuid": "d0eb5e28-05ae-4039-8ec6-5de4b552f123", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646845951, "uuid": "9b63e78c-3066-44bf-918c-40011bf5b17f", "value": "8691152.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9a5c66b-9fc8-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1646844553, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646844553, "uuid": "e6590197-883a-4fad-9496-bb6ff0bd3575", "comment": "Malware payload (AgentTesla)", "value": "959436f79efc41b808e0c33e191b700f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646844553, "uuid": "2a292260-beca-4b05-8760-522946916f7c", "comment": "Malware payload (AgentTesla)", "value": "a92b9d41ef2982ec53d0886470fcd68c71bbea29e92eef8bd305496d882d2d7c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646844553, "uuid": "912efad0-82fb-449e-b41c-770aa7321b60", "comment": "Malware payload (AgentTesla)", "value": "4bdcb21f8e52d372e5b9d4706efc2709f2006c2d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646844553, "uuid": "717b11ab-31ba-4510-98b5-505231875ee9", "comment": "Malware payload (AgentTesla)", "value": "f872c515335923f0c5dc6ea77fbe587ab6814fc35c8cc6a6b658183e21a8ada0bf19331749f92119beff4cc3ed40637c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646844553, "uuid": "c89164b2-b90e-4218-a2fa-6c4d02a84500", "value": "T19025DF109DAA503BF27E9A791BC5F96749DBB1B61604E1BE2C2CC6890FE193CDD81C31", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646844553, "uuid": "a6485c07-f0c9-4b69-8857-91365c2fa9d2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646844553, "uuid": "bf8f4a9b-129c-4257-b03d-9753928f6708", "value": "24576:LofpMz9mglQ9FPlS0v/Ja5UE37O6OMygWrMQNAA45Rhe:LaMzI4Q9Pv/Y/372MygWAD5W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646844553, "uuid": "2f481ba4-7062-485b-9e1d-5c008e192744", "value": 1007616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646844553, "uuid": "2afaeec9-33f2-4d0d-98ed-d48bcface635", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646844553, "uuid": "e2009521-cf60-4bb3-91fd-eb8414e6f7ac", "value": "959436f79efc41b808e0c33e191b700f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f06d3377-9fc8-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1646844591, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646844591, "uuid": "45388701-4fee-40b9-867a-b8c25579e579", "comment": "Malware payload (AgentTesla)", "value": "f3c8b73dd5483c02c9a1dcff63bfdb64", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646844591, "uuid": "7480ae07-86c7-4438-af96-f8ba2799979e", "comment": "Malware payload (AgentTesla)", "value": "aaa1975edab70102bf583bad356bf682836246e9e65c3303c607d32a3f3e5bc8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646844591, "uuid": "bc827b0b-ca58-424c-81d5-06b06be0e467", "comment": "Malware payload (AgentTesla)", "value": "aaaf65e7c9b416681b908fae44f273c15c5c30a8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646844591, "uuid": "601be143-60bf-40d7-a382-2c85875ae042", "comment": "Malware payload (AgentTesla)", "value": "fd3e263d182bbc49f5e17221ea10c9db07cc6f3c2016dcdf7d617ffcebced2076a2ee3e301811fbc7dfa25f79597add0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646844591, "uuid": "7c5b74e7-2d1e-41ca-bbaf-eda2fde8dbba", "value": "T128057DA527E87F44E03FBB3C943414808BF8B94BEB21D69E3CD540DD7A72E815B61A52", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646844591, "uuid": "45b6dce7-0e6b-4201-a2d8-66ef87c67e6a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646844591, "uuid": "1c33c335-14a8-477b-8341-0bcecc4e1fbd", "value": "12288:Lj878vARzW3ZhOENuB501VEUxeHt/4pMwejU14w49y:v87cAlWJhOdBKTEJGMwn4d9y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646844591, "uuid": "9783bdd7-fc29-4e66-b68b-48d36f074059", "value": 819200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646844591, "uuid": "00e92ea7-b144-4ad5-bbe7-470efe4e79e5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646844591, "uuid": "f74012a7-42c9-4edc-b808-31576ccef052", "value": "f3c8b73dd5483c02c9a1dcff63bfdb64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69794e8c-9f9d-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1646825896, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646825896, "uuid": "c35834fa-fdf9-49db-8dbf-6af6d7fc3044", "comment": "Malware payload (AgentTesla)", "value": "c8610cce4ccf00559f5db13e59855ce6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646825896, "uuid": "82440c7c-b539-4ce7-a48e-bffbd9a60595", "comment": "Malware payload (AgentTesla)", "value": "aabe1da6365483cfc2dde2c3cdda06accbb6a4a19f9509bc133e8c41c7df5b1b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646825896, "uuid": "7e118bed-c41a-4196-a9e9-20a547e6bf7e", "comment": "Malware payload (AgentTesla)", "value": "7d04b76d22b6d6e674ee0a4889051daaa58fd8b9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646825896, "uuid": "a3fe5a0b-98b2-4e70-85c7-8f399f566f7d", "comment": "Malware payload (AgentTesla)", "value": "253c8414b57048021ea4ddf795523a479a3ac2220c210b23b5a4d4f242d15a2938fa467e7c8f68e3a730b3deff7d1b2f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646825896, "uuid": "1694a5ba-f0de-4a5e-b69e-3c2632aa8b47", "value": "T1FD35AEE629EF401DF377ABB16FC8F8CE986AE673151A30DB10911B768523A80CD61735", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646825896, "uuid": "b7d55842-e898-4667-9f44-984cd8432bab", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646825896, "uuid": "8d1e01af-0dd9-4f25-b275-a0d2065b924f", "value": "12288:HZt3Zy3WD5kPLJhPrtCoaPWx4rTME3P2RsURri0jHehaWGxsMhEeFIgNA1CRu8BN:zD5kF2oaYE/6swAwWGhL6g7Ruu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646825896, "uuid": "8959e1b4-0ae7-4bf6-b4fe-017ea30f856c", "value": 1100800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646825896, "uuid": "9ec8e7e3-b5aa-4376-8998-fb85ae463354", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646825896, "uuid": "f0de8ef4-d664-4352-b363-a573cdc9fb7e", "value": "PO_HBK30.EXE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d8a48bf-9f93-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1646821501, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646821501, "uuid": "3d2f5e86-ac6e-49b8-a909-19e3865a069e", "comment": "Malware payload (AgentTesla)", "value": "ddab5a936b1bd752361da4add612f964", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646821501, "uuid": "eab4456f-c9cf-4a3d-8b55-05fdc2810648", "comment": "Malware payload (AgentTesla)", "value": "ab12565bc10e4d3702e4179ff2561900c536dc1769c72144a56e400d17fd11cb", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646821501, "uuid": "18b88434-e067-430c-b94d-986dc48a6b71", "comment": "Malware payload (AgentTesla)", "value": "25fd6c015eafd97ea58052858fe54fae08e7e65e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646821501, "uuid": "36752db6-985c-4751-ad1e-62312cdaf136", "comment": "Malware payload (AgentTesla)", "value": "92f513a58112104111e5dce9f5f3ad67470324b689ddd54c5e193c0db4239866c54eeb9d6bca0666c500ffbf8c8e81cb", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646821501, "uuid": "2cbdac51-0b8c-441b-a2cd-bddfb1ff032b", "value": "T13E05334BEE32D8C51635361E8A90E52F7C767596D2C7FCE8EE9AA4B58F90DE00914CC0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646821501, "uuid": "fc818f24-7cc1-4169-885d-b1043cfd32b7", "value": "12288:VKDtJSUP6tSdIQPpx1Mdet5Z5JoKF++DL2VKxqfUNK765vH+0cv06kicOz1pX:qSsC2pxxt5RvfDyfN7UH+RvdkPS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646821501, "uuid": "54647ddd-ca49-4e5e-b9e1-3f2239be9492", "value": 821311, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646821501, "uuid": "63caeddd-2da2-4dc2-bead-a86b579523fa", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646821501, "uuid": "f29b2779-931b-4c22-a9cf-ef79a1257c98", "value": "quotation enquiry 9854000.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "174e468a-9fec-11ec-9275-42010a9c0029", "comment": "Malware payload (NanoCore)", "timestamp": 1646859689, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646859689, "uuid": "2e0af8ad-7b72-4fdd-bf89-4340a4726784", "comment": "Malware payload (NanoCore)", "value": "c4a5a94ec9d5ac3f7433a8142345c870", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646859689, "uuid": "72502970-8cd5-4ccf-b237-822d6d947e73", "comment": "Malware payload (NanoCore)", "value": "ab313de1fa68e4beef7e4796c80ae75453242dc17225d7cc9370384bae3e47c3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646859689, "uuid": "c0bb1c16-8b5a-4a50-8762-8b9d98b1b239", "comment": "Malware payload (NanoCore)", "value": "2a15f089c19fe9877233fe7f2e72c212eab07a93", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646859689, "uuid": "1bc3f6a2-b11d-44de-a69b-3959cae6fc5f", "comment": "Malware payload (NanoCore)", "value": "212a06ebdd5f9fe5c02e94600edee2c2d359497cb8926066b9d7a1f537f3842e56d6035b9f3539485de1e7b531560fc4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646859689, "uuid": "4ec1a0ae-ba9d-458b-8adc-3f28688bccad", "value": "T17B24CF163BB8452FE2DE86796112061283B9C2E3E9C3F3DE69D451B24F277E50A071D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646859689, "uuid": "c8edf672-3817-4966-ae12-9c37f2830ed5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646859689, "uuid": "906ac9f9-dbf6-4315-a82d-17b31df9ec98", "value": "3072:EzEqV6B1jHa6dtJ10jgvzcgi+oG/j9iaMP2s/HI8tQ6f5JWRFoFUkJWHHglML6Wd:ELV6Bta6dtJmakIM5R0oKkIwf4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646859689, "uuid": "11110680-f224-464d-922e-ae116f36cdbd", "value": 214528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646859689, "uuid": "3047634c-463e-4abf-9020-da7e26b94b04", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646859689, "uuid": "e4d78e3e-f26f-4f6e-b981-bf03c74f7cbd", "value": "AB313DE1FA68E4BEEF7E4796C80AE75453242DC17225D.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c773459-9fc5-11ec-9275-42010a9c0029", "comment": "Malware payload (Quakbot)", "timestamp": 1646842947, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646842947, "uuid": "0961e7df-c1fa-4a36-956b-53da8f142319", "comment": "Malware payload (Quakbot)", "value": "274361ba64bb2bd1220f9a4ff9c93b3a", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama164", "colour": "#6C68A0", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646842947, "uuid": "87c9f570-b7d8-49e3-b2cb-3c9d90e961a4", "comment": "Malware payload (Quakbot)", "value": "ab53d57528418fc17ccc52d03c4cf27775ae901f4391c2a6b6aebfca042888ef", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama164", "colour": "#6C68A0", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646842947, "uuid": "6f779cff-dbac-4533-a7f6-bd36ffc8ec95", "comment": "Malware payload (Quakbot)", "value": "51d3918c003656d328c97ff8414623cd4f620090", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama164", "colour": "#6C68A0", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646842947, "uuid": "60a89eb7-05f7-4724-8d81-ba0b034dfe32", "comment": "Malware payload (Quakbot)", "value": "018bccaa976f2fae5dda34bad8f72520df43fa9a170e3f002a3a1f6455d05bb72b0521d181b2f0908dd9288451291aa1", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama164", "colour": "#6C68A0", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646842947, "uuid": "08497b59-491d-4730-a2df-faf2f064c549", "value": "T17F657E23F2C1887AD4761A3C9D1B739998BA79112D28F4C77AD44E8C1F37A433666393", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646842947, "uuid": "b21eb1c0-2936-4bd4-bbda-beacf572121d", "value": "cf78a88c4b0403a976a85038ec51a351", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646842947, "uuid": "abe6e129-1f38-4cd8-a33a-5e47a85c2813", "value": "24576:LP2GXxd5hyXOZk/R8SoMbEYN54UUrW/tRJfJYOIU2SAHl4XoWSIgX4T:Lu8jI6kcYN9RYiKKgX4T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646842947, "uuid": "58ee4d0e-2515-4d25-80a4-e4c2922ee704", "value": 1502720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646842947, "uuid": "6c7b785c-2aa3-4794-906f-338126ea8244", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646842947, "uuid": "892bbc13-12b4-487f-8304-f7894c4fad2d", "value": "7796124.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "708429b2-9fe5-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1646856832, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646856832, "uuid": "48980f45-b611-4d76-82e6-3b65390170e9", "comment": "Malware payload (RedLineStealer)", "value": "6bd29fde7829c07050a79f081e1eb3a0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646856832, "uuid": "f8134209-d39a-44b1-8591-18ae78e14f62", "comment": "Malware payload (RedLineStealer)", "value": "ac149ae2a35a8c8942c0057ab6435aa2c1b7b69a30c3a2ef20d41615507656e2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646856832, "uuid": "7d6de0cd-5d27-4a07-8216-eb883ac13320", "comment": "Malware payload (RedLineStealer)", "value": "99fe9d086dccecc08b9a3f2ecb350f3faca99142", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646856832, "uuid": "3316bf49-0422-4210-9b72-96087b845752", "comment": "Malware payload (RedLineStealer)", "value": "2b501552a82b5e8748e2b2dcc0edad5b932d8d395e2e86fa7bd81ff0bf7f3a2d5021bd69c1c4417a13080eb819571a4d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646856832, "uuid": "d582f2d9-65dc-47cc-b123-0d2aad3a4e12", "value": "T110A34DA973DD4628F5FE4E7479B1515143F0E1A2AC02E79B4EC4A0DD1E26B80DB12BF1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646856832, "uuid": "f0606f45-9e4f-4b13-b5b6-d415f6b3af0b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646856832, "uuid": "7c2385c8-e5e1-455c-8536-e337b40fc872", "value": "1536:n0DmkCrzG2IlAZcZWYqS3NwSs3E7K5tJX4AbuTxqOrjdHX/L/:nWCrzG6GPKSsU7GR7O3dHPz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646856832, "uuid": "f82a3648-4d45-447e-8ecb-093036057cec", "value": 104448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646856832, "uuid": "e7759963-96d2-493f-a7fa-e565b326c385", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646856832, "uuid": "c0a09bda-6a88-4b89-8405-6e62fd4ef74e", "value": "6bd29fde7829c07050a79f081e1eb3a0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4fe1bf60-9fc4-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1646842604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646842604, "uuid": "f2e873ad-156e-4854-a390-a9ffc80c9893", "comment": "Malware payload (Mirai)", "value": "50aa51a4d04b66ce6a54c6cbf3c85f49", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646842604, "uuid": "d0b22e2e-714a-4e09-9787-2612ebd6f1f9", "comment": "Malware payload (Mirai)", "value": "ac22d3c7c478164200ad13d769ddf71584572d018c0e8a9f070fbe8956f2e794", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646842604, "uuid": "85e0a8d2-785b-4688-8386-8080d36b8fad", "comment": "Malware payload (Mirai)", "value": "3856117b3119ac00e87261e94ead3c4bfa175ca3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646842604, "uuid": "6909f055-fb5e-4e5b-89a5-34e523ae47e0", "comment": "Malware payload (Mirai)", "value": "97f6922c17545554663f11684712932c08e4bf56097d90d132c27ae64a99654747885d4edb7fe03ad39e19e33a00e845", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646842604, "uuid": "e6ed0662-7ed5-4bb5-8031-51778b6283b6", "value": "T170B2E1D712A8025BE88956FDEB1F3FA77202A8541FDF5EF16754D98826B32685780C08", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646842604, "uuid": "5da12892-e1c0-4ef6-b38e-cd6d12f1ad9c", "value": "384:Mj7LalTr/lS3rOVT6rJoA/0np7NYLPr/oIZeySzi4uY1XiBNpld/pciu5uwYuniX:M7m2bOVWNj/0njYLzPSzWH38uwYugI2L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646842604, "uuid": "28801f97-7217-4ec3-a07b-2c16fb31fb7f", "value": 24548, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646842604, "uuid": "6b73e4c0-f89c-4042-a25f-a6323d1523e2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646842604, "uuid": "2b607f11-82ad-486e-9106-077d70b69c35", "value": "50aa51a4d04b66ce6a54c6cbf3c85f49", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b467703-9fbf-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646840476, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646840476, "uuid": "3032ec8d-bd07-4b15-9e88-50cd273c819e", "comment": "Malware payload (Heodo)", "value": "9500240f3cbb5d5ac72eb9dbdb409cdc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646840476, "uuid": "3a7c9e8a-c64e-4827-a710-9ae3a1c7a667", "comment": "Malware payload (Heodo)", "value": "ac49074024f9cb9e242d7d8e735a8efd3ed466105b7f7db4c3040bca5491ea9d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646840476, "uuid": "3a3db4b9-2ef0-4357-95e3-496c483154ec", "comment": "Malware payload (Heodo)", "value": "4fce8a8570614ff41d2b1f8fdcc0fdca26771265", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646840476, "uuid": "8a5405d0-aa95-4735-ae33-43ed8852a63c", "comment": "Malware payload (Heodo)", "value": "665d444380c8ca065e109ce2bfd6a25d23b8e4349c1d13a5f73b7e145c4c5cecfcdef6f8033b630f839a6868c3549070", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646840476, "uuid": "ff568cc9-db1e-4ead-b021-8df50687327d", "value": "T1EF257C107E8A817EC71B85B30836676D6FFEAB204B6CA1CB478175ED2D316C29B36705", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646840476, "uuid": "a32de6d8-4f62-4666-bf95-3d78d957543c", "value": "087c9809507dfca4c3283e6c7539e91c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646840476, "uuid": "4caab3b6-b6ac-4707-a335-47c54d73d65b", "value": "12288:cR5SOyRHiA6m0OcElbzt6JtcS1j2xKkr:cR5SOrKlbzEtcK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646840476, "uuid": "1c599001-eaad-44f3-ab87-8476fe8025fc", "value": 1040384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646840476, "uuid": "906a4566-ca1b-44b8-a0c8-ce76173555a3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646840476, "uuid": "442ef6df-ddab-4c84-9fd4-8fc6b1bee8e1", "value": "9500240f3cbb5d5ac72eb9dbdb409cdc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a07086a7-9fc1-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1646841451, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646841451, "uuid": "be9a4f9e-67a6-414d-98ec-19a388981d85", "comment": "Malware payload (Mirai)", "value": "0641f68a35c635b01e91c22964175cf2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646841451, "uuid": "fffe8684-78f0-492b-b438-e133f232ef65", "comment": "Malware payload (Mirai)", "value": "aca444df823a61e30d793173dc306a77eb84e2e63517f7e69b53fb02c2e9ba58", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646841451, "uuid": "dd929c49-9df3-4cfe-ad0f-86f481c93f13", "comment": "Malware payload (Mirai)", "value": "44218c2de0f92c71a999acca0365fd5862ee9420", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646841451, "uuid": "4bf0fa95-1208-4f83-9f61-2cfefcd8d820", "comment": "Malware payload (Mirai)", "value": "4a21d69aed709361c211ecd296746da6e591b24d14fe609b83352b90a8a6b3ff7a6cc3c830e1bb31a20b8265468c105a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646841451, "uuid": "ae201ef1-3586-4e79-ac2a-9984819884d9", "value": "T1A273730E6E719FBCFBA9863587B34E209258339226E1C545D16CFE011E7034E746FBA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646841451, "uuid": "1519c8a1-2794-477a-9720-f55507070c1f", "value": "1536:K41wLUay6+vl/N1Gg9ffUo95EPY/jU31OFJGVov4WjwAXZ:16ry6+vdGg5Up6CsJGVW4UwIZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646841451, "uuid": "00d14293-8e18-4e20-bd0a-fd979bf96a82", "value": 79804, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646841451, "uuid": "8b62bedc-a108-4c2d-8389-1c9b5d7b51d9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646841451, "uuid": "f0546f3f-9dc0-43de-8a72-b6e7b5220dc6", "value": "0641f68a35c635b01e91c22964175cf2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff11a2aa-9fce-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1646847193, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646847193, "uuid": "f27855ac-2e09-441a-9bd6-8582eb89ff7a", "comment": "Malware payload (Mirai)", "value": "8f8d38fffb5c20f64fa950b8a1d45708", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646847193, "uuid": "ff1b6e83-71f5-4a3c-888c-c8e54b24c845", "comment": "Malware payload (Mirai)", "value": "ace14a0e8dd8ff8241c64984f30f6656d103b91cb4f181d0f05af06f238cb7d3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646847193, "uuid": "e610f73e-9f5e-4988-bf45-564e12e284e8", "comment": "Malware payload (Mirai)", "value": "ab54c8e73bf709b79399c597ab1772c03c61c729", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646847193, "uuid": "01330efa-722e-410d-90e3-daa5be05f2e2", "comment": "Malware payload (Mirai)", "value": "3aef31289ce1af1d265dc1106cd56c0a9307072fe40f33da865ba17e67879aad047d340b87edb0db845e21e32339626d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646847193, "uuid": "60060798-5863-4360-b009-a51b85342d60", "value": "T17D634A01775C4E43D1A61EF8293F27E193EEEE9021F4F5842A0ED6465272E33994AFD8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646847193, "uuid": "6658e920-1006-4e83-8fc8-b2cd906ab48d", "value": "1536:ZjVO2KsrO4zb5Bd1YBpTaQnQSe1ECj5ds:CPsTHd1GNQSe1bjrs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646847193, "uuid": "db30f38e-415e-44a7-bacf-a1ae80d062b4", "value": 67576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646847193, "uuid": "f5cea830-ddf4-4b93-8950-3e63b70d4d1e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646847193, "uuid": "f00378b5-439f-4936-8cdf-1e8a314ca72f", "value": "8f8d38fffb5c20f64fa950b8a1d45708", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d075f4f4-9f78-11ec-9275-42010a9c0029", "comment": "Malware payload (NetWire)", "timestamp": 1646810178, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646810178, "uuid": "43adb81c-e5a0-497b-8208-866ecbe2938f", "comment": "Malware payload (NetWire)", "value": "096a9c0a4491148f3f4f76cb2bc42495", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646810178, "uuid": "389a69da-9498-4cf7-a661-1fc7abe72e66", "comment": "Malware payload (NetWire)", "value": "ad2a4c7b0a58ac2e841eaad428581b697a5a0a6589165cb5fd5e7550e9029f3f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646810178, "uuid": "1a77a757-f2df-4166-8d3a-a8beb1e7517d", "comment": "Malware payload (NetWire)", "value": "d8bcefce0162c05167db8654ee3cb5ed1880876f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646810178, "uuid": "622d1bc7-b168-4c87-bef3-68e6c5507165", "comment": "Malware payload (NetWire)", "value": "2d6422fca92b4ed8a32afb6af96b21e99f746e7d6f08ea6748f5063ab5611cdbcb253028265f332aebf0b0a06fa733ca", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646810178, "uuid": "74a013df-5eac-465e-922c-136b689458ae", "value": "T1D325ADE629EF501DF377ABB16FC8F8CE996AF973151A20CB11520B368423980DD61736", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646810178, "uuid": "f7bfed67-5c96-461c-897d-2d4327b0ecca", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646810178, "uuid": "238c3935-7df4-47da-ac1b-44b68d2d29bd", "value": "24576:9D5k+9lDcK2Xd3+F4887Fn6+zqY63k25VX:9D5k+9lDL6dOFv87DuDf5VX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646810178, "uuid": "4cddea63-1707-4f4e-973a-5ef1af76625d", "value": 1022976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646810178, "uuid": "6e431da2-5b50-4fff-890f-a63dc2af2148", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646810178, "uuid": "4ac7428a-aaa9-4221-aabb-4e775bc91f3a", "value": "Proof of Payment.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "730f4d63-9fb6-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646836650, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646836650, "uuid": "6987af21-2eaa-4fbb-8b96-209f46e40f13", "comment": "Malware payload", "value": "3fcd4630a98b13b20b5b2c98d32138ab", "object_relation": "md5", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646836650, "uuid": "ac5b053e-c0f3-4693-b582-546531e8b448", "comment": "Malware payload", "value": "ae1875d84578de33147aa6a13293b15af610a73835eb5c7d91ab77a83b104c1a", "object_relation": "sha256", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646836650, "uuid": "c6d5570f-eb54-43cb-b107-91d8539940e1", "comment": "Malware payload", "value": "1f8f284c953d955aab79f506a84566448aa41813", "object_relation": "sha1", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646836650, "uuid": "910436b1-d212-43bc-8cfd-28e8705fc11f", "comment": "Malware payload", "value": "d722411100081b964a846002059b0b196f224cb31958aac1ee5f6d65c772d719b2d23a07bbcc653051fbcf54cae80a78", "object_relation": "sha3-384", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646836650, "uuid": "109339ab-37a4-4f07-a146-2544abdc1a28", "value": "T186B30145306BD243E1A44E78ACE2D2E263A1BC09EFA1C30777847B0D5879668CC6765B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646836650, "uuid": "dff3dab9-36e9-48b7-909f-3d80f074bd2a", "value": "3072:w14EfeIk82BTtva5PIlm8MCJIO/SvxUx0sU16A0:BQg/vSwQGJIO0pv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646836650, "uuid": "92b49557-087f-42f9-bd33-c6b175a58431", "value": 115200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646836650, "uuid": "32305682-3533-4fb9-9050-77bcf4305e9c", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646836650, "uuid": "96da85cd-d7f3-4521-b7ac-25e2b2268d23", "value": "Payment Advice Note_220930.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a159117b-9f93-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646821695, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646821695, "uuid": "3e73142a-0fb8-45ac-866b-99a3978c9cc0", "comment": "Malware payload (Heodo)", "value": "141e13e5294a4d240b711e0cfc02d561", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646821695, "uuid": "7f866cf3-7b31-4246-be72-75be72f45c34", "comment": "Malware payload (Heodo)", "value": "af396d76ccc14aa0d54d2e1a8ae90fd0f48498a29fe2779b2fbc957cb8662cf7", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646821695, "uuid": "82fe04d0-25ac-45d3-8da7-d975d474375e", "comment": "Malware payload (Heodo)", "value": "a5f5bab62b933549451b157cc8bba7c77f1f90ab", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646821695, "uuid": "d05b38a3-eeb6-434c-b69b-1359b0338834", "comment": "Malware payload (Heodo)", "value": "73f19e1df3af8fe4cfe98e9a776a058c6da0ce624839b44074ca4fe7c1e959ef9211e1498d01e337755d395eb5d11a7e", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646821695, "uuid": "be267766-93f8-461e-8960-704789c90b37", "value": "T169337A6B96D4B43BCE138C3D8D084F9A7E4B940261C09B72DF4CA65C7A8F1B51E4B4AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646821695, "uuid": "b9b099c7-8cbd-4e4b-bac6-16d516a1ec68", "value": "768:yYCKEWvxLh0lSQHAamYDSmPq9A3Bj9DLC+9uSEcmQThnuG3KA05lAMIB:yYu2xXncDSmSIBlGeuSEcm2h0B5lqB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646821695, "uuid": "19479c65-0bff-47a2-aff4-68a2dc617e5c", "value": 51015, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646821695, "uuid": "32e109ce-214a-4afe-a147-c1aed35902b8", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646821695, "uuid": "535f85d9-f3e0-41e2-b9d1-8c98be7450f3", "value": "attachments_3715.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f61deb69-9f73-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1646808094, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646808094, "uuid": "b3dac1c5-0be1-4fb7-945c-be2b399d0b2b", "comment": "Malware payload (Formbook)", "value": "bea32e2801fb5563f449be19c809b1d9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646808094, "uuid": "f4d8b841-382d-48e5-a777-635041c4fd01", "comment": "Malware payload (Formbook)", "value": "af5c1edc2e290ba4ecafee0f7f5b02182e5df7672ce8004ba3bafd320f2592f3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646808094, "uuid": "dd968e20-c65b-4c86-8572-0405e95f7496", "comment": "Malware payload (Formbook)", "value": "9eeb43a334e7315d6de967e7d7a9f61fa818b2bb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646808094, "uuid": "f52f33ea-e528-418d-b573-97d233cbf9d0", "comment": "Malware payload (Formbook)", "value": "5a39f6f1d7f5c2efabf3ee026aa43716b6205c883859964713328c992ea61a6883dd5b763202449dac339a8b2c91b009", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646808094, "uuid": "1ed8017f-7816-401c-a8e8-c5e91b3c2c44", "value": "T103E5E0527E0C5802FCE116B4CD29C6B962567DD43960A2A601EFFE7BF5BB383C85D482", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646808094, "uuid": "648b45f5-1900-49cc-9218-4159ae7c89bc", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646808094, "uuid": "f2f8c565-3ad8-4bd0-b25e-a6b035689567", "value": "49152:kh68+6vxgTQfoI6EMcTvOpF89DmMI+VQ3Yokg/KxBpupmCIYQ78P67IVLsrHuPHl:kQ8+65gTQfoEMqmm9FQodMz67ItPln", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646808094, "uuid": "2a8f9d93-5a00-49d6-84c4-cbf8686c9dec", "value": 3246442, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646808094, "uuid": "903dbe38-8d4b-4c07-9b62-eb610c023a66", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646808094, "uuid": "fc4704fc-6707-4df6-82b8-62c2246532a5", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ccdf62e3-9f40-11ec-9275-42010a9c0029", "comment": "Malware payload (NetWire)", "timestamp": 1646786120, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646786120, "uuid": "db9162aa-29e5-4771-b07f-abc52d3246bb", "comment": "Malware payload (NetWire)", "value": "0f34bb9f4cbef8b2b2b3bd0cea0c9324", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646786120, "uuid": "4b38dad0-71e6-4cca-a176-1a39ef9a6d32", "comment": "Malware payload (NetWire)", "value": "af880994009ae32acf2ac7f09f2c7ce28abe8aa20580ef6d5248690698601077", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646786120, "uuid": "8879e05f-52c9-4472-9e02-03d3c4c99c0b", "comment": "Malware payload (NetWire)", "value": "46b558e330a305c1f2b27d4a572a86322355e75f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646786120, "uuid": "68c96119-0cfe-4e05-b456-bf0392a27807", "comment": "Malware payload (NetWire)", "value": "051b0dd4b20c82d83d5c749657056be3c0ce4d4964561d7b6ae4b19b84867d8c268bccc4c1d463396543d18454f833dd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646786120, "uuid": "0ea1c9a8-398c-474a-bf7b-5a5c95262cec", "value": "T1AEB2EC106254772BC56F85727CB19F493226BE70B492AFCB64833E3EF4336A6065871E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646786120, "uuid": "bd370eb7-062b-494d-931d-5308024d9618", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646786120, "uuid": "be1d3051-b725-44a6-8d9e-3759c8ee631f", "value": "192:DNARLqgxb/ryeXG8zV0ESi+0MKVh9Ohynhh/hhhhhhhehhhhhhhhhhhhhJhhhhhy:DNaLqgxb/+TCV0ESilMUHqywyb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646786120, "uuid": "dbaa09fb-b9cb-4c00-b327-8ef8b3e6f34c", "value": 25600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646786120, "uuid": "98aa5cc3-a2a9-46e3-a422-c42377aa60c9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646786120, "uuid": "f70913db-1fca-4c15-8340-b39dba7c3d88", "value": "7852100003078510025.scr.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74be9c2c-9fd6-11ec-9275-42010a9c0029", "comment": "Malware payload (CobaltStrike)", "timestamp": 1646850397, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646850397, "uuid": "ac3dd642-65af-4d23-97e1-6289f6b16050", "comment": "Malware payload (CobaltStrike)", "value": "dd28e93fa65737390d7f1553e0ce8bb8", "object_relation": "md5", "Tag": [ { "name": "Beacon", "colour": "#3CE751", "exportable": true, "hide_tag": false }, { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646850397, "uuid": "185b5d56-e98e-4c45-a4a4-ca6da5fdc598", "comment": "Malware payload (CobaltStrike)", "value": "b156d3fddec3ec4b06b17703426bdd76896e70784eb3c29d085d385b53ef6f09", "object_relation": "sha256", "Tag": [ { "name": "Beacon", "colour": "#3CE751", "exportable": true, "hide_tag": false }, { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646850397, "uuid": "df2a91f0-9e43-474d-b3f1-827d79434cb6", "comment": "Malware payload (CobaltStrike)", "value": "8e484470b1bb95d51a625fb31bfc8877655c298e", "object_relation": "sha1", "Tag": [ { "name": "Beacon", "colour": "#3CE751", "exportable": true, "hide_tag": false }, { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646850397, "uuid": "08d30459-a373-465d-8bb3-02838659b08a", "comment": "Malware payload (CobaltStrike)", "value": "6b755033136a631cb35f70df5992207a3571cd5823ded02ac8ea80af63d61236d284b2a1a6fec3a2d059ca0af0af1dd9", "object_relation": "sha3-384", "Tag": [ { "name": "Beacon", "colour": "#3CE751", "exportable": true, "hide_tag": false }, { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646850397, "uuid": "5f3496d0-a63d-4198-b6be-56cb3f3f8927", "value": "T151656D7D8AA217A4D47AD53098221D038AF1FDB111B06EE3C7D9765ACE3F7E25234B09", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646850397, "uuid": "10882480-308c-45c9-8766-b5cd0d7bd19d", "value": "d4d1207e63433210521fa12525a70925", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646850397, "uuid": "103ff216-e164-416e-a5c0-50787fd947d2", "value": "24576:5tu1+d8K4xB7ADvwnLXThiq1W4epDUV+u/eND1zvPn58Lq:5Rd8K4x2Dvwn3h/AAV+LbOL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646850397, "uuid": "ffa55def-002a-43aa-9b45-c6dcb17bcb62", "value": 1454080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646850397, "uuid": "f8ed6990-e7e2-4ff6-8309-902c5cdd3f22", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646850397, "uuid": "f3fc3414-7e78-4b86-ac14-8f64dd8d4dd3", "value": "jtyhssdclljc.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b043185-9f9d-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646825953, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646825953, "uuid": "a9821f33-7c77-4c80-8499-043d7ee19348", "comment": "Malware payload", "value": "80fea9cce76cac9f032c4df66f35056b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646825953, "uuid": "dcedf998-9758-45c7-aef0-5c2098b20a82", "comment": "Malware payload", "value": "b2ab5f57e86b6298f017b2dd26dce307c80c7dbd7c36d62d0ddd92a2a07b7b87", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646825953, "uuid": "d1631e4a-627e-475b-b33a-b524eff3b0dd", "comment": "Malware payload", "value": "4ebe79be90b595efea5361f670e5ab483bcbc5bc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646825953, "uuid": "c7a09c89-cdd7-46d5-a9d4-2a321d1c1756", "comment": "Malware payload", "value": "a6302605aa682f2566a4fc31e5e950f9aa2c034bf11449e1bbdaecd673910ce2c484d4896c448ab778725e1cb3351aa5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646825953, "uuid": "1d0f36f1-3e41-407a-a2be-79616c428c89", "value": "T123643E55BE58C652C18A8DB49DA2C7F01A51FD116C0D25AEFB923F9FDD3A722DC0208B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646825953, "uuid": "f75b27bc-5933-4c87-8424-8ee8de7a662a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646825953, "uuid": "a506bb52-6e5b-4387-8937-7dbb4752ecea", "value": "768:FPYZ7ZPqjSOZHscOoVnWxpqPSf+PQOd7Bdx:Jy7Z8ZMjWgsHPQOd7Bdx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646825953, "uuid": "b44b9875-0fe7-4bd4-88d7-b11f4009f900", "value": 324096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646825953, "uuid": "5d19d5fd-b0c8-4d16-8f14-f3aaf51e9ffd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646825953, "uuid": "73cac059-03af-4a6c-b335-3cd5b6d1ba97", "value": "PO#3260913.PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0dfaeb4-9f7c-11ec-9275-42010a9c0029", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1646811950, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646811950, "uuid": "02431cf9-baa5-45aa-a2d9-015977437c39", "comment": "Malware payload (AveMariaRAT)", "value": "9bf05a813fa2e1aa8297ad3e7c041d40", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646811950, "uuid": "bfffc7b9-1718-45d4-847f-842553d2b18d", "comment": "Malware payload (AveMariaRAT)", "value": "b2f14c5f0a9a9b8efa4ea6be1db290c7a082b02816bf043a538f71a93dccfe67", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646811950, "uuid": "06856b9f-3afb-4e4e-9aef-f542c291a69e", "comment": "Malware payload (AveMariaRAT)", "value": "4bcdd830ea68b3e2351714140809efdd5a268dd0", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646811950, "uuid": "f08d2b6b-8fd0-4a60-aa16-35bf9b54a4ac", "comment": "Malware payload (AveMariaRAT)", "value": "23acea5733e74b540ce00d3435663922ac8c79ac4f9e029ede6d361a80a782cf70830c4b698b746ca4a6f00067ebd8da", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646811950, "uuid": "6bc03d79-d6a1-4bd8-aa99-c5cf2e3834dc", "value": "T11B84221C9576BA3A24288A3D5DCD81339FC86073A6D9945199EF1FA43EBA43D8C4C7C3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646811950, "uuid": "a6b5e5d7-7424-4741-8056-74d7a17dbe80", "value": "6144:m43m0Mqfp8nK9V783CBR3bC3EsRKNR68wcnWJlvqzmedSYA2gwMgsej81yb:mgXMqVT7uCyEUKNRlwcWJlvqzldrg0se", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646811950, "uuid": "fafc9bdc-4ba9-4449-a70f-08c1b86cf57e", "value": 379260, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646811950, "uuid": "0a22eebd-9ba9-4fb7-a313-9a0feedf6847", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646811950, "uuid": "a4935c5a-0ac4-42fc-b191-f2bc6c6c5994", "value": "POINQR02016Aspirant Contracting.tar.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c0d98ff-9fbb-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1646838866, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646838866, "uuid": "e1d2c685-008a-46df-b97e-d35bbb2abe66", "comment": "Malware payload (AgentTesla)", "value": "bdb5a405c8985a9df7e2a048f8005b39", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646838866, "uuid": "f2c6124b-5d2a-4a11-9320-c6ce5cc1c102", "comment": "Malware payload (AgentTesla)", "value": "b3686d471e53312442e66354a290dee688bbc79051fb826a10de88a3674d9391", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646838866, "uuid": "c0db5081-29b8-4e35-9eb3-850088004af8", "comment": "Malware payload (AgentTesla)", "value": "21803816d7cc683fca1cb1f3c2ce81ae6cb48334", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646838866, "uuid": "0320e68a-9afe-467d-97fc-030a8434538a", "comment": "Malware payload (AgentTesla)", "value": "a958698e5ec96d071b8df9269c758bf9b371f0d77049a6e7de6f19f0753d5e8256be86712b250ec77f7dee444fdef397", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646838866, "uuid": "dbb98c3f-175a-4d04-a5d9-f75038a5a141", "value": "T11015E0AC7690769FC417CD378A541C20B6A0A4B7470BE307A49726AD9E4F2DFCE251F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646838866, "uuid": "addfaa12-7484-461b-b0fe-f1e88a00ca48", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646838866, "uuid": "666ff487-7bfe-4c5a-9bd9-f0acb0a78287", "value": "24576:jQmTErOluX402jPCNvUkyTYeYGA4Xm7QTFgcGur+5DaLrx7:0mZaUzdRAL2gcGur+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646838866, "uuid": "5d753030-68f0-4ffb-b455-aa5a4ddd320f", "value": 899584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646838866, "uuid": "03e8ae3f-8407-44c4-b650-999e353c55e6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646838866, "uuid": "df3b3b6c-0d3b-4982-809c-29884158c4e3", "value": "TWESGM2.5_RFQ TransW2022.03.08.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a0e72a3-9fd8-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646851184, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646851184, "uuid": "318607ab-32b8-4e5a-9ee1-dd7e42bc6c7d", "comment": "Malware payload (Heodo)", "value": "9f46ed46b4c4f709bd5d3edece1a8fe5", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646851184, "uuid": "666de9e6-efa3-4e0f-be6f-3d004e7aa0a2", "comment": "Malware payload (Heodo)", "value": "b42ab327e24cd16c2de189ef22b85d3b75652e8ade5bec1e19efdb6bf46ca646", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646851184, "uuid": "84941f86-720e-4c3d-8942-a0738dc2fbc4", "comment": "Malware payload (Heodo)", "value": "38508beb58dfcb3bcc8744bdec309ed01ef31b2a", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646851184, "uuid": "f77e3ff3-97c6-4b96-b02a-d82648d02de1", "comment": "Malware payload (Heodo)", "value": "5131b16cb245ee610142371d1b74c76f622c211f7f9b1b28cca6b69af3f26ccb7b2f167d597b327495a45dd8a32ebbde", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646851184, "uuid": "9e87a6d9-6ae9-48ba-8ee8-df99408b4722", "value": "T1E613D02CE65B3119C6359C7D561CDCF56E0821975409DA8B2848FBCC2EC1BF722AF19D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646851184, "uuid": "4e66512f-647f-4fe0-be7c-0f2048c71bd9", "value": "768:VCToSyUnZpOw+pyZfQCwBzii1H/KNsH7meB1Id5qXkm1qVw0je7:VQsUZpOw+pyZfQCezfCNRejIdcXheRj+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646851184, "uuid": "ac2dfbaa-2d6b-4ab0-89a9-107d766d841e", "value": 44632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646851184, "uuid": "110b5900-cdd1-4da7-a91e-301cfb69380d", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646851184, "uuid": "98cdbc8e-0909-43e0-9654-0ed0ae8de417", "value": "sin t\u00edtulo 83141.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9bdecd2c-9fd3-11ec-9275-42010a9c0029", "comment": "Malware payload (njrat)", "timestamp": 1646849174, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646849174, "uuid": "83507ff3-6313-4143-b0df-4e0cf0291e35", "comment": "Malware payload (njrat)", "value": "77dba4801ebc93b96b8166858fcbb288", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646849174, "uuid": "bf03f02e-b659-4eaf-a181-638dd90fbad5", "comment": "Malware payload (njrat)", "value": "b4401786ef72c3baf0f60c69e620839a1967cb79d398aae5ec9f5eb84fa46705", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646849174, "uuid": "294332a2-224b-45fb-b5f1-d54727b5e3ad", "comment": "Malware payload (njrat)", "value": "4ee4eaabd947ad1bf69e59bb110b648c1afa1834", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646849174, "uuid": "e341b390-9039-4832-907f-c862e2336675", "comment": "Malware payload (njrat)", "value": "7bd0bc3afbe38c91fa94d54b0004c7b47dfd97178a803d37e471a75e5e5198beaef032daca96af2e63f147b4b62853aa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646849174, "uuid": "2d7d17b1-0029-4fba-8faf-ff05d4d595f4", "value": "T1CE353350B11F80B1D1229175BC322B62710AAE57FC18283ED7576CE0BBBE67DA605F87", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646849174, "uuid": "c5304b39-fe94-4aca-be26-f447f886f427", "value": "2e5467cba76f44a088d39f78c5e807b6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646849174, "uuid": "ce97d0ca-5c25-411b-8a2c-41911be0d5d3", "value": "24576:XiPHkR4fyOYGNLfSLPqnVWlQhgrPAflNg5cW8LjKoxyXxwI0AzsuSe7/o:SP1fxPLfuPqV3hQAfTgX4xAw49/o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646849174, "uuid": "6fb71ba7-3f0f-42ff-8d11-bf55ee62de15", "value": 1129984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646849174, "uuid": "9ae2ffde-85a7-4cb9-ab91-5f38750abc7f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646849174, "uuid": "61f1ef49-e613-4c27-8b62-ffb7cf8bbfa6", "value": "77dba4801ebc93b96b8166858fcbb288.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8bdbc8cd-9f82-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646814358, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646814358, "uuid": "756db281-a97a-4b6a-be72-9cb2029396ef", "comment": "Malware payload", "value": "4afde1190b9e84b7ae7e523c80016795", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646814358, "uuid": "c1989c3d-2d56-4f33-9246-208c001fbaf5", "comment": "Malware payload", "value": "b573027b0c9e177cd737ba9122308f86cc497e943ef5d3ec0f453c1b3f8d6a3e", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646814358, "uuid": "18dc0052-522f-459d-88bd-bd07795881aa", "comment": "Malware payload", "value": "c267c5f2ca19696b7a5d5d98e7ec1e0e58fe3f8c", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646814358, "uuid": "1893676f-2326-4737-8bfd-7623907917b6", "comment": "Malware payload", "value": "767d545d3ecec2fb52abca83218688106e4eac56748d6117e850d18b75648d540994b313125ddb2bd63b1373ec1a7cd7", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646814358, "uuid": "e698ded3-ae6f-418b-96c4-406690142107", "value": "T11272C0B5A5324E5BE6755D3B8BB3037B82BA951E94B36FDD0C00391D0DD0AA405A3B31", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646814358, "uuid": "4f7e85fb-de39-4064-b1b9-9debc43ce13e", "value": "384:o+dC9RZL/QHBD8wYPcWhNqKZT2MHpUnD1oitt:o+dChLKBD8wYJ/pUDu+t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646814358, "uuid": "062563e0-5161-412e-b242-f5ba54cbedda", "value": 16928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646814358, "uuid": "920872dd-0604-4137-9333-b33c2efc7a53", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646814358, "uuid": "3e57d2e4-117c-4b3a-8a5f-3bcce47e95db", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c27b5ad-9f9d-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1646825901, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646825901, "uuid": "7e84cde9-dcf7-4cca-933e-aed3fef07b50", "comment": "Malware payload (Formbook)", "value": "da867f31d500f19ec488e3f1dfe0ea0e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646825901, "uuid": "d7d4ea86-28d6-4c5e-8051-93e729ba2c67", "comment": "Malware payload (Formbook)", "value": "b5c72b1b2b27ec19137e65b0522ed9205cba9061e98065ceaaf44716fdc5cf41", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646825901, "uuid": "b1c93ff9-93f1-46d1-9944-a146f8f236fc", "comment": "Malware payload (Formbook)", "value": "f0f38ea8f4a7e79a60e7b16da58212544c930b6a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646825901, "uuid": "2460175f-aa96-4e93-8286-a699a2b977b1", "comment": "Malware payload (Formbook)", "value": "5ba2a3215a2e17b0a4cc7ddea119e222b0a185af5e867ed641203d2795b822a3dcab474c2158fb5d38abc91b39ce2c4f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646825901, "uuid": "18a91063-713e-43da-af4d-8aa8af8431d7", "value": "T10B94F14513DD90A3CDC5CDB85AB6D2B88AAFBF964E344007624C6AE5ED3F16B05603E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646825901, "uuid": "db99bbb2-8aab-4cf5-bc4d-db2f287860d3", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646825901, "uuid": "820ae201-b009-42ab-84bd-5c57e695ed96", "value": "12288:oOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOS:oOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646825901, "uuid": "32dfc8ad-1a6a-4ab5-9ac0-a500660714aa", "value": 411803, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646825901, "uuid": "1e09f69f-9081-4dd1-bf00-fcbcc848ebb5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646825901, "uuid": "6acb85db-b72d-4c0e-b973-de0ef036aeab", "value": "Purchase Order SFOWRN5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3990876-9fc8-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1646844597, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646844597, "uuid": "f3825443-dcc2-4da0-80ba-9456b69d8e5a", "comment": "Malware payload (Formbook)", "value": "95d60664267d442e99c41e2aa3baff68", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646844597, "uuid": "c8d0cf90-10f8-4a8d-b44e-69cc4cbb9180", "comment": "Malware payload (Formbook)", "value": "b5f79bb30d60794b7edbf486fa96a11c1ac3ba34592a496379020e8379f281be", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646844597, "uuid": "cc33da90-1de3-4d7b-9b19-4fe7d06f7a38", "comment": "Malware payload (Formbook)", "value": "6b8d7ac057a4d13c6b9e5a0fea0a710afc9eaec2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646844597, "uuid": "f37a6627-2024-4ad7-bf6c-fe4d2b47ba07", "comment": "Malware payload (Formbook)", "value": "0d7359e558a5b8d2ddb05ed5c88e24b89b2d1fc090d4fe15a63a59ba5ecec39c6ae34de3d04b075f174fe8d36f294163", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646844597, "uuid": "505da98e-72e1-4053-9604-52952ed5bd9c", "value": "T110F48DACBB582A5BDF901AF2899650063D25374CA1CED2312E8FDE40F0E6CB5967435F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646844597, "uuid": "08732522-a72f-4efe-ab61-a37da3f273e5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646844597, "uuid": "f914cf56-8edf-4fef-8acb-9f62230dd5b4", "value": "12288:ICFPIqSbiZICTR9CJYxpfG91p/vVnfNTgD4NovfhwlRYjoqkJJjWmxs+1ETj8g6M:7FwbiZI8R9aGpejpXVVKYKAPqz/MuR5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646844597, "uuid": "ee827da8-7b6e-4403-bdfa-28419751e76f", "value": 769536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646844597, "uuid": "9d89543e-a3c0-4c66-8145-4d6da41fa9ca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646844597, "uuid": "015eb501-1592-406c-9aab-aac117ab09f9", "value": "95d60664267d442e99c41e2aa3baff68", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "131080d0-9ff1-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646861829, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646861829, "uuid": "219233e7-aca8-4a64-aac6-123c099114ef", "comment": "Malware payload", "value": "fe2ee84a8a913504071284a1129a269b", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646861829, "uuid": "bf435cda-7101-4cc6-8ec3-db13d8bc4aab", "comment": "Malware payload", "value": "b5fb6dd2ed0f9ae2b21938fe1746fb4372bd629e75709498c67fefb724131eaa", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646861829, "uuid": "5950db97-fbb0-4448-aaf5-8d89cd3fef77", "comment": "Malware payload", "value": "b0837e053305fe5979bd3074d4a861bd616312ae", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646861829, "uuid": "1be81c16-6480-465e-b79a-74cb03bab5f1", "comment": "Malware payload", "value": "ff68d81f058571dadfa4b3dc3f647278c3046759876c637718be432ca6c8528bbdba4e78a6b9474b55c800f950c36aeb", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646861829, "uuid": "e12d0a49-eef1-4c86-baf6-96eacfa2e6e7", "value": "T194156D113781C037C11B3C3286AE937E62EA9A314FA5E6875F9475BD8E345C2DA3DB06", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646861829, "uuid": "1079468b-f5fe-44f7-ae8b-a4766ffe7f73", "value": "a517173f90c43414bccc160c37653529", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646861829, "uuid": "77296e46-5840-4fe0-945e-345604cb97dd", "value": "12288:4mZ2fbGh8Nggu3uTkIKD56pInvq0fPJ7/2fdwVW4SqPje88koKiaCx:4Bu3uT5KUpInvPfodwVW4Sqf8kiaCx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646861829, "uuid": "a2777cd9-7726-425b-9a73-251b38200366", "value": 956416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646861829, "uuid": "0601aa08-d9ce-4442-b4ab-ea8f0dc0e041", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646861829, "uuid": "6110b86c-97c1-4f9c-9951-64cd4aa1c062", "value": "emotet_exe_e5_b5fb6dd2ed0f9ae2b21938fe1746fb4372bd629e75709498c67fefb724131eaa_2022-03-09__213704.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "980c3327-9f3f-11ec-9275-42010a9c0029", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1646785602, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646785602, "uuid": "ed2e863e-f8f4-4d7e-807b-07609c94a31c", "comment": "Malware payload (ArkeiStealer)", "value": "ac4d557b5e0cd0855e671b32a807e75a", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646785602, "uuid": "6fc4286e-d172-4b73-b528-3f5046efc2a1", "comment": "Malware payload (ArkeiStealer)", "value": "b61bba8ff91848c1f2b60dd8c98de6979f14c3366826e4d5c18c130758d5f050", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646785602, "uuid": "28f27834-7fa0-4c3f-a7cc-b63e857a3af6", "comment": "Malware payload (ArkeiStealer)", "value": "b945f2529b6e262ed86f8f21fa5524dc262a4772", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646785602, "uuid": "e0239278-911e-4998-8d1c-bb106941d1c4", "comment": "Malware payload (ArkeiStealer)", "value": "9d3eb81685a600ea7cb2257b02297c27ade7058c3b5fb0edf7f33e476aeb31e2479c29f2ab9628f8aefb19be62ea6188", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646785602, "uuid": "3ed74951-dc1b-4177-8979-3aa1dc0a9b90", "value": "T1D054121394D26F37D4D60AB00BAAFBBAE7AF52D0105B9C3367642FF71BB198584520E1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646785602, "uuid": "80791552-e31f-4078-a707-156518ca5f4e", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646785602, "uuid": "ce640181-a1b6-4fcd-b78c-1f5a00f9a426", "value": "6144:rGiomEuCdd1yzECR9MRkH6JH0Cf7ME68IZGKbYctPpCkD6/:8mEu01yzjR2a6JUCzVhoGOYctPAk2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646785602, "uuid": "75c2dabe-1f63-4f69-ad12-b78d8b0624b0", "value": 303670, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646785602, "uuid": "c58b9eec-efb8-4543-a714-14c647fb000a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646785602, "uuid": "bed73d92-c2bf-49a9-9b7f-0289233f21f9", "value": "ENSI1056732.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bfaf1ec6-9f51-11ec-9275-42010a9c0029", "comment": "Malware payload (STRRAT)", "timestamp": 1646793399, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646793399, "uuid": "4e992474-b4f0-4c30-b0ab-c5c322b30eef", "comment": "Malware payload (STRRAT)", "value": "68653e9ad4d240a722102bce7b5fc16f", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646793399, "uuid": "53131897-8ecf-44d4-a30e-092cacf5c09f", "comment": "Malware payload (STRRAT)", "value": "b7712965f172e71f7d9ed4991110343e95798c012fa07c18c7f98f2444446a49", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646793399, "uuid": "83201dd8-ebd4-4248-97d7-eab758415510", "comment": "Malware payload (STRRAT)", "value": "8d46da630ef46189bb8ec8eccce4188e4c97b2a5", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646793399, "uuid": "c351c9e3-e1bc-48a9-8845-031cbd56d426", "comment": "Malware payload (STRRAT)", "value": "ccb7c76541d0f7794daafb67af7e8c8243f14f2885fdd728e4d7149161091ef25696fd1e9fb1822ac74c0310e67fa060", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646793399, "uuid": "7823d9b6-fd5e-4b53-9b14-b36f57e16d3d", "value": "T15204F15E3EBB81BCD46794725010D267275C5DA8D447AC6B2AFC289B5831C6E0B0ACEF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646793399, "uuid": "d2b24cf6-cb59-424b-a2ae-a9a05535eb5b", "value": "3072:22TApHvJgyTZTRsUoIAhacZEmyF1zJAlxq47IPX4/66SGTmTuPJQ3FN+Uknc6UCL:2SyTZTRDAhacOmyJA7ECSGTeuBQ3FN+D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646793399, "uuid": "d456607a-b249-4fa7-8875-43c7b4da20eb", "value": 182454, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646793399, "uuid": "9558348f-2165-4d7e-81c1-607121204b51", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646793399, "uuid": "00f9832b-9c39-4e3d-b6d8-54b3a5a32670", "value": "SHIPPINGDOCUMENTS-BLINVCUMPKLISTPDF.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e283d50f-9fbb-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646838984, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646838984, "uuid": "532785f2-1bb1-4e16-b41f-f3fb3483cc90", "comment": "Malware payload", "value": "9c7a0b469fad339fcd0db43d2ad5de69", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646838984, "uuid": "f5f8fb32-685e-4697-b664-2a7757b3991c", "comment": "Malware payload", "value": "b7a8e474125b7815ae34e84c7f80271bb80911c4532f58b2a3bbffc574f29505", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646838984, "uuid": "626e822e-9cbb-4c3e-b1db-a2c24c782fff", "comment": "Malware payload", "value": "04787e3d4105a1e20773b293f1c40a410837c7f0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646838984, "uuid": "ae909f3e-b88a-4078-86ec-0ff5971265a6", "comment": "Malware payload", "value": "74d838c250e04d62b7eb114606d7baca715f0ddaf2f1fcfd38aaffafbca772a530d6c6ef96985693a324408bf11090f2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646838984, "uuid": "91b14aa6-596f-4fbd-bc24-c46adb2f6afe", "value": "T1A044121A72C5C053EE7616318DBD86AE3FF4F89D0544972F2751AA68B8732818F2C7E1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646838984, "uuid": "1c20e3ab-b9a8-480a-aa7e-fcb168a7c65c", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646838984, "uuid": "473fd190-7626-4733-871b-0815cbc7b17b", "value": "6144:lYa6PKZOuE1SDIssGilA+XG4LC0g4XAiGCIH6h2izocdy:lYtKZOd0DQGixXJeOXAiQYdy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646838984, "uuid": "06ad82b6-b326-4739-b35a-ea71174579e9", "value": 273379, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646838984, "uuid": "ba45e7bc-a4f0-45bf-a2a9-36bcb31faea2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646838984, "uuid": "36f3edec-bf48-4128-8475-e75f74626738", "value": "9c7a0b469fad339fcd0db43d2ad5de69.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77faaec8-9fe5-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1646856845, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646856845, "uuid": "4c44bd26-9656-4c28-ae92-6ad4b01d9d48", "comment": "Malware payload (RedLineStealer)", "value": "4d73ab573bc59bd02b6e6d45f5e12209", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646856845, "uuid": "99f66c25-bd1e-4fbe-b7e8-2124581933ae", "comment": "Malware payload (RedLineStealer)", "value": "b7e0c2db7858462fc4fe8d2d6cc6c9e376be6c19c6440ea9fb578f2254e59437", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646856845, "uuid": "bd626925-715a-442f-be1c-310a845b0485", "comment": "Malware payload (RedLineStealer)", "value": "3c5731bba6d32c5751b72d99ab36c7322bfd56d8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646856845, "uuid": "68c3900a-764c-4596-9dcd-e18b54cf9109", "comment": "Malware payload (RedLineStealer)", "value": "f2f05f05fb03b882ff656f2efd813e2018c73fc0a1358d0ccef4f8405a9b092626b1917bc3b3aac651f8300647421a05", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646856845, "uuid": "6ea6c946-4cf3-4cb1-9e9b-e37677ca48c6", "value": "T1CB3633CA1CAFC25ED3B9E93B1D48B6CB87D11A129CB1388601650D1EF6F4BDB95201F6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646856845, "uuid": "eaccfe39-aa8e-4eb7-b18e-6b970f699252", "value": "fddc083fa31a17c938d0a17ec7cd3025", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646856845, "uuid": "952de960-5875-4424-9eb4-696d16ec94c9", "value": "98304:x2MUgGFIiIMVymXAH36qtCITNm9GGY1K9dfXNHW9I3TF+WdTBiHPQw:xFGFIiIMVRwqY5ZGa4XPFLsHPj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646856845, "uuid": "259c22fc-3323-40f7-8a4c-639be3cd3c6d", "value": 4967368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646856845, "uuid": "9ec883c7-4efc-4d5a-802c-31946a065a3b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646856845, "uuid": "eca02c6e-47c3-4e96-b00b-c6b5700321b5", "value": "4d73ab573bc59bd02b6e6d45f5e12209", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e7504f3-9f7c-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1646811785, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646811785, "uuid": "5c2684f3-4f96-49fc-9472-0cf4bdbaea84", "comment": "Malware payload (AgentTesla)", "value": "ce451d955b7717980d4b0ea170b6054d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646811785, "uuid": "cdc176d1-6f5c-42c8-9bfe-937efa3e09af", "comment": "Malware payload (AgentTesla)", "value": "b7ea135c5f97d17c2d2bc7e8f27ca1449ddb06ba1cb1756202d60df950869b3f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646811785, "uuid": "74cd32fe-8338-4fdb-b224-8745488410de", "comment": "Malware payload (AgentTesla)", "value": "988f099fdb6adf639c4be2a7b206ae39ae767471", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646811785, "uuid": "c2c07b1e-04b0-4e1f-9dc2-b876bae08892", "comment": "Malware payload (AgentTesla)", "value": "5f6a105e7435099950c32d402f2e4156b79e6993665dac54e5020054747b45cf5f75143e691498f1b26498b9d77828c0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646811785, "uuid": "d951eff1-6d2f-4930-a036-f0843211462a", "value": "T1B6D2F104F86BE39DD405D0B493685053DDA6AE43E0932DF6AD88E65BFB8D6344F1CC88", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646811785, "uuid": "08c10ef1-3fdb-4127-a438-361d34a6c85a", "value": "768:7Q/dA6Zl1dr1UaaYy3u3U/QyuDSu0MGN1RA+o:7Q1AcpNanIDSpFS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646811785, "uuid": "150b3371-d506-49bd-84ef-81bed4f95937", "value": 29978, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646811785, "uuid": "cc018d20-a8e7-44b5-81f7-50ad0dc6fb05", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646811785, "uuid": "b72d3b35-1bfd-4f85-b855-0c656c2da223", "value": "5903214.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8decbf5-9fbc-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1646839317, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646839317, "uuid": "545426d5-03ab-4161-84aa-57e03f6dc6fe", "comment": "Malware payload (AgentTesla)", "value": "6c5a3eb4a380d255320c90b105c5636c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646839317, "uuid": "dea2a88d-8cfd-41dd-8c67-0ee8d007821f", "comment": "Malware payload (AgentTesla)", "value": "b907a7a57cabe27869616bf543f284e2e5ed84e8a6cdd5f42d8ebfe1e012c0bc", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646839317, "uuid": "55647485-1352-439a-ab12-eea664b342ff", "comment": "Malware payload (AgentTesla)", "value": "21c8055ab2dd5a63b527a768a05f2cf9f10e46d1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646839317, "uuid": "b3d07218-07f1-4fc1-94fd-ee76ccb4ea52", "comment": "Malware payload (AgentTesla)", "value": "f0e907cba8a03d7bafeb90dc3defddc84bd76a34808a9721da011a392b5a38ccbd437d5a02f313b0e334809a4457120c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646839317, "uuid": "bb14c11e-049d-40bb-b48d-900d86fc9bda", "value": "T1B115335E12420FC6C352EF1221329DD843FABB96CA3123CA927D165F659122ECEDCD6D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646839317, "uuid": "85e263d7-8050-4a3a-a229-1b45f1a03622", "value": "24576:NMvdLpmdhDIwDVHphxSrX+7uwUQhHkX9FdEnPZ04imw:qlovDIwDVHUrX+Spn9DMPZ04lw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646839317, "uuid": "f72b069d-465d-4078-bdab-d06365d41026", "value": 920781, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646839317, "uuid": "b3f30581-a218-4e77-9932-56960f6bc8cd", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646839317, "uuid": "a2dedf23-feac-4937-a77b-d589bbf6a54d", "value": "POCWI19150.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "069ac523-9fc4-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646842481, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646842481, "uuid": "9600908d-02c6-4836-8fe4-fe973b4aad71", "comment": "Malware payload (Heodo)", "value": "3faaf651f0f17154a2b1138e6efac854", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646842481, "uuid": "4ee40227-6909-4c4b-8285-6c70e65e189c", "comment": "Malware payload (Heodo)", "value": "ba350eece3f895b0e6198b9d69bf142ab17ad7a86d3d5b5fed81422ef0ba7515", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646842481, "uuid": "6c9a10cf-ef43-45d7-bd26-b2322d538a05", "comment": "Malware payload (Heodo)", "value": "cfbf7eb701d336d14f91fc76d19683a5c6b22dec", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646842481, "uuid": "211b1b66-aae6-4d3e-bc5d-9435034c0f10", "comment": "Malware payload (Heodo)", "value": "1c734aafde3215be8789a1835e9a81b4b8ecdbc47c02734c8ac342748d5a4f5f4c440478e35e28d47d2cba239f06557b", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646842481, "uuid": "bc671e29-1d17-4672-9771-e20abc508d50", "value": "T15E257C107E8A817EC71B85B30836676D6FFEAB204B6CA1CB478175ED2D316C29B36705", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646842481, "uuid": "7c651aa2-dbbf-4dab-ac62-36f91f8abd0f", "value": "087c9809507dfca4c3283e6c7539e91c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646842481, "uuid": "c450043d-2745-494b-84e9-2f785d237443", "value": "12288:cR5SOyRHiA6m0OcEl0zt6JtcS1j2xKkr:cR5SOrKl0zEtcK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646842481, "uuid": "86aa51dd-2243-41ac-922c-36d88a91eeec", "value": 1040384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646842481, "uuid": "dfa09255-43ff-4df7-b323-d6036d12ab06", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646842481, "uuid": "05224ff6-f913-405b-8eff-6c20ca1cee3f", "value": "QRYb.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d61c908f-9fba-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1646838534, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646838534, "uuid": "07f8df08-0988-40cd-a574-7e92f95f1bb4", "comment": "Malware payload (Formbook)", "value": "a27844ae60feab6cd127d641712b89a7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646838534, "uuid": "464de8bc-7762-4392-b9a2-a9f73f9c2903", "comment": "Malware payload (Formbook)", "value": "baee118f4d8c83dee2936549ab6f303e84bd427c0c87e937033afb3956dc2123", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646838534, "uuid": "8cf7b96b-4268-4b74-9009-85514bd2d874", "comment": "Malware payload (Formbook)", "value": "4d2d07085b6f7da752b90feac0545f909987c88c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646838534, "uuid": "587d2486-1bd2-4832-90c7-a5f5f231d997", "comment": "Malware payload (Formbook)", "value": "c8ca2b7acd9638eccb0d29b8e03294f1e4b58e857cf2705a8cffbfae4506bb91c09d2f73662f203652ebb209117ceb6b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646838534, "uuid": "4b8ed340-1e46-42bf-bc88-5093f6de0261", "value": "T194741306F998CDB3F2EA0936957B612E6EF782CC055A0D53BF410FCD28F3699444927A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646838534, "uuid": "d681b703-9850-4da8-9627-895c884fc363", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646838534, "uuid": "5105c07c-f127-4343-8250-b5cc60ae0b52", "value": "6144:rGifNF4If597rG1Ulu2IbWD65D96zRjq4pteL+h93A7njKFCkCt2h1oElv6Q:sIR9P+UzIbE65D96pqIULcSnNkCsoWh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646838534, "uuid": "b6df3793-b2b4-4862-b165-0c774015da9a", "value": 345395, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646838534, "uuid": "88c32fa9-db7e-4441-8ceb-a422ecdce012", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646838534, "uuid": "dd4ea3d9-7e46-4292-bba1-a46368ac002d", "value": "Dekont.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2937b746-9f96-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646822782, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646822782, "uuid": "5b42c03f-b564-4a2f-bd09-31e74d5d41e2", "comment": "Malware payload", "value": "af3f898c92c50383880b350e36da1251", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646822782, "uuid": "e217f613-b53e-4b8f-b093-4ef18d636210", "comment": "Malware payload", "value": "bb808ae23f0fa7738196ff2fdc8e4ca86b7fc2ad58b8e3675ff8c0610c625c2d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646822782, "uuid": "efc35798-8da9-4821-8c6c-fb91a58cb773", "comment": "Malware payload", "value": "f2482fbc444e3110f11151c9d5a961e82ac47346", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646822782, "uuid": "5fcbf829-5c79-491c-a6e4-632cfd36ef22", "comment": "Malware payload", "value": "0f9917e66e1a000e1d15e001cc31216e3fa1b041588e469490939d972c04f69868591ba2ba2614fb15be29571261deb7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646822782, "uuid": "db392496-cf6c-4faa-b305-00f7699e10de", "value": "T1EB84BF06BB8859AEC997083183E171FC76D7AA169B41F79F1058753B3B2383B0F25B49", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646822782, "uuid": "26b7af09-6d8a-4aee-9055-7085ef6d0f63", "value": "6144:dxjvopWaIJC1tNAF9ketwFezbx+xgmAboMqaYQAUXhE2zN8tY8MrpNCo6J7:bvnaBuCFMxYDd+YQ5XhE2zKtYTrpNCo6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646822782, "uuid": "a30c0160-de0a-4662-a044-250e0c6add51", "value": 382304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646822782, "uuid": "eaf12838-a5e4-4c70-ae40-64dbd4c9a19e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646822782, "uuid": "051aa31e-e339-4964-b41c-4c713c74c2f2", "value": "SecuriteInfo.com.Trojan.Linux.Generic.242213.26619.12245", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1cb053e1-9fe2-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646855403, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646855403, "uuid": "66a5c02a-b724-42c1-84bb-44dfd49728ac", "comment": "Malware payload (Heodo)", "value": "7c17eb693032606f2ba9e24adc0d96a0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646855403, "uuid": "a8125707-08c5-49d9-9a34-7e9f795f33f4", "comment": "Malware payload (Heodo)", "value": "bbe557fe7a0f79411284720316b7691bde902ea6a7bc698bd56140dab544d202", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646855403, "uuid": "a60842d5-eada-4794-9cf0-1dc837fd7a08", "comment": "Malware payload (Heodo)", "value": "2a172de5657b5098e1c0662909f4dfd77ae4b463", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646855403, "uuid": "c7c2f6cb-18ca-40f3-a773-01cf73defd2e", "comment": "Malware payload (Heodo)", "value": "68cf145f2d3b60fe96a7998266ab3327274bc8aefe6aee96dad3e1d3fc5217ea3affc57912a4fa00dce6e53b700999ba", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646855403, "uuid": "1aee9011-443d-40e0-a236-12d3efda6af0", "value": "T13A257C107E8A817EC71B85B30836676D6FFEAB204B6CA1CB478175ED2D316C29B36705", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646855403, "uuid": "a7beef99-63c1-4c26-9c22-819e0296ecf4", "value": "087c9809507dfca4c3283e6c7539e91c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646855403, "uuid": "94f10736-6d71-43ab-af7c-a5269dba4941", "value": "12288:cR5SOyRHiA6m0OcElJzt6JtcS1j2xKkr:cR5SOrKlJzEtcK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646855403, "uuid": "f50066a4-efd8-4622-b7f5-100446098a67", "value": 1040384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646855403, "uuid": "5d3e87f6-1a94-4ef0-9ba3-d8480c80d460", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646855403, "uuid": "8490a848-3b0b-4c58-9723-6257c3af23ce", "value": "7c17eb693032606f2ba9e24adc0d96a0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a51ab65-9fb6-11ec-9275-42010a9c0029", "comment": "Malware payload (Socelars)", "timestamp": 1646836501, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646836501, "uuid": "4cdbee68-9758-414a-b57c-b953d4e68f59", "comment": "Malware payload (Socelars)", "value": "042ca64cd53c293dbaf62fb2e7fec7d8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646836501, "uuid": "07f23cab-a9e0-4b2b-bbf5-43d20d68f0b6", "comment": "Malware payload (Socelars)", "value": "bc793c49510f507da1e28c886af7ee596e5eb341a242125f56d46bc7925f88f2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646836501, "uuid": "c96f290a-a2dd-4f4f-ad73-615b4190bb4d", "comment": "Malware payload (Socelars)", "value": "2bebcd198f464eb52b110e57c26bb2ead09dcc01", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646836501, "uuid": "f93b0433-aed5-4956-89ea-140c7619e402", "comment": "Malware payload (Socelars)", "value": "0d8bc504c35de2193e7ee113b33b8785d1db2465aa859c1da26b9d8bc234eb0067f6625f4fac93adbee5e4706f7fc9d9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646836501, "uuid": "f5effd26-11c6-45f1-8c72-df477042c8cf", "value": "T12A659E11F6425036ECE310B3C5BF4AFE8D687E21031494DBE3C47A6A5AA15E33637A5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646836501, "uuid": "cfd524d7-0388-4935-9a56-d9d99e66a9c8", "value": "d69e4c13e25f0ad622344ac56118c0df", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646836501, "uuid": "51dd94cf-ab7a-4d47-bd6a-913d9d46a34a", "value": "24576:UKAgpBGV2HpWHuREjDnI2AuADZ8KvqC7mH2dtDPc/dgKFCYg:agpG57R8jnDPc1gKEYg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646836501, "uuid": "7eca8bff-f280-434f-a657-c83960e65986", "value": 1522176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646836501, "uuid": "690524a1-af64-42f7-b386-41de63a3e444", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646836501, "uuid": "4c289917-7b42-4fe5-be30-c2ce857fce7c", "value": "042ca64cd53c293dbaf62fb2e7fec7d8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c136079a-9f8b-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1646818313, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646818313, "uuid": "afe0cdf2-8e33-4a7d-b77f-a75672600477", "comment": "Malware payload (Formbook)", "value": "b138fe6332aa5292a9e75ea32bc5a16f", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646818313, "uuid": "e44811b7-2f77-405c-9af5-8e66ebbb284f", "comment": "Malware payload (Formbook)", "value": "bd4e54f9823ed48efe0c4593be381f9b94e09c93ebbd807e91e33ff50660745e", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646818313, "uuid": "001f4a03-ab27-4943-8ef4-bd73fc52e8bc", "comment": "Malware payload (Formbook)", "value": "81d9a46da39d113ad42e711b628f1834fe9df341", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646818313, "uuid": "65c204cd-4259-423e-81c2-eedc816dbe5a", "comment": "Malware payload (Formbook)", "value": "6dc81c10775068de2c0ff0d2ba78ce59ddc047b1cdc212b287380fcb39b15c7291bb5081347920054453a7b1523d9c7e", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646818313, "uuid": "27bdc4bb-98cc-4115-bde9-6d22af7df9b3", "value": "T13AB4239E3A413164B587D487BC5F939C717EFEABA58878F9DB02918313211AF68C3B50", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646818313, "uuid": "5f49fe24-3123-42dc-bbbb-b78266d693d1", "value": "12288:1v4Yk3PfyluufnYcmifljFNIRd0LJ7Lwm/p:1Ajyoi1O0LJndx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646818313, "uuid": "b1ead41e-dc0b-426e-b5be-481c3756e1a2", "value": 522177, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646818313, "uuid": "dd176c26-a242-452b-8409-5405e6ce4aca", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646818313, "uuid": "65d1bf69-1b12-4e8a-a879-a88a2238734b", "value": "ORDER.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e764077a-9fd9-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1646851878, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646851878, "uuid": "546e9528-b116-44bc-a668-69ddf26863da", "comment": "Malware payload (RedLineStealer)", "value": "a0258f011bd5a6a721651236571d9a8a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646851878, "uuid": "1ec38ff3-0d51-4b8e-ae89-a3dda19a66c2", "comment": "Malware payload (RedLineStealer)", "value": "bdb1a17dbb8fadb35bc79b7947eae76dcbece4789dce0195c240dd2ec70a942f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646851878, "uuid": "d571f64e-ca4a-487a-a6b8-ca6df91c3e14", "comment": "Malware payload (RedLineStealer)", "value": "59424611ceba50aced6f35c5a16bdc8f40b7bb97", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646851878, "uuid": "081af1de-58ed-4113-821b-c20e1d141e2e", "comment": "Malware payload (RedLineStealer)", "value": "8201bda1b4c8f75b1ce0d105333366df4e847a39132fbee9db0ea3fe7fbfbc8102d22fad543c6d656304ffd6655a5e05", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646851878, "uuid": "b6aeb084-faf6-4eee-bbb4-f0301ed7993b", "value": "T1E8558D6373019DF5E55D08B14A4AC6B005A07C6EDAD5062E72CCFA1E99F338224FF9DA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646851878, "uuid": "0ef550d2-9582-4d4d-a6d9-cc52494aecd2", "value": "9355f6dae3f035674db72b3dea6f6001", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646851878, "uuid": "3eaaf890-8b3d-4512-afe5-271446f10945", "value": "24576:6RCFyARQHLqqxd+O2QOXIcEykEYguw4Pp/:hbQHLqqx0COYWVAwKp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646851878, "uuid": "941e8597-ad44-45eb-a76b-e9041576397a", "value": 1296400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646851878, "uuid": "05d7c3da-c4c3-4739-9207-452b5699ad6c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646851878, "uuid": "3ca5417a-0500-4c81-a4da-cea306034e9c", "value": "a0258f011bd5a6a721651236571d9a8a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79ed7a69-9f9d-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1646825924, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646825924, "uuid": "7168553d-1a43-429e-a5ba-f62094c9c7aa", "comment": "Malware payload (AgentTesla)", "value": "70380e8f5ebc3ea1335b94be198828a0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646825924, "uuid": "a98eb3e6-4797-420d-8a70-9134589ac9ce", "comment": "Malware payload (AgentTesla)", "value": "be123de6d4152bff7260ecdb9cf106f359b04a900f6c25a8e8c99b999442f2a9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646825924, "uuid": "0c3336c6-d5ca-4a19-a0a0-25c204371a36", "comment": "Malware payload (AgentTesla)", "value": "48ad988a7f5ecad7b5db835cdf84762a9d2d8c7b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646825924, "uuid": "63e81705-c62c-4580-b0ce-1dee074a417f", "comment": "Malware payload (AgentTesla)", "value": "7c025fa3317a8fb37002278c22273571d1660b8b8efeb347874a970a81f80f30c25a48f0dfab7d01b35202841617d399", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646825924, "uuid": "22db77cf-b5b0-4023-b6c7-dc1560f947de", "value": "T10E520790A799CAF4CAA50AFF6CB353110728F753E5258F0F35C5631AAC13B1646B2F12", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646825924, "uuid": "74d2996e-4df2-4e3c-8f0b-902aba6b8323", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646825924, "uuid": "1e1c99be-8b79-493f-8679-890566d5b296", "value": "384:H2Gl6qFuaBUV6ESiNCH6O6iiay9ycyrsR2vZctc2:YqFua6NbycyrsR2vZctc2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646825924, "uuid": "061e08c3-3c45-4bf8-937f-0cb9ae158c86", "value": 13312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646825924, "uuid": "9c82ad29-2197-4c1a-a5f5-4f2deb03a765", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646825924, "uuid": "90e0d658-32b8-490e-9601-9d87e9c720ca", "value": "5908732.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79553b49-9fb2-11ec-9275-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1646834943, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646834943, "uuid": "f00a9b80-6e44-4f9a-aa2f-c4f74834ad56", "comment": "Malware payload (SnakeKeylogger)", "value": "942feaed352c912d3bcef7c21b85abde", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646834943, "uuid": "4f9e79bf-6062-4a82-af40-f7920f3c3933", "comment": "Malware payload (SnakeKeylogger)", "value": "bf5d723d1aad42badd397bcbf0fa52e7bcc401232c1feea72cc85cc323627704", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646834943, "uuid": "63c1494b-e9d7-419f-a590-aabc61d406a3", "comment": "Malware payload (SnakeKeylogger)", "value": "c614cb447541787bc7f356543807b7bba62f934d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646834943, "uuid": "46a4049e-a1cb-409f-b47f-81d45b50f1db", "comment": "Malware payload (SnakeKeylogger)", "value": "71e1a601a6898d608861e96c5dafb7391aea7614d16763316a5efcd3e2eb924465996dce701bf4c0ce943bfab7107a38", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646834943, "uuid": "04cdb063-c831-459e-a29a-59d285b6a27e", "value": "T174158DE629EF505DF3379BB12FC8F8CE996AEA33151A70DB10821B368523990CD61735", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646834943, "uuid": "2330604c-872a-423f-9f6d-a69dfeca84e5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646834943, "uuid": "47f1b292-13da-480d-aa17-8ee8afdd65a0", "value": "12288:ZZt3Zy3WD5kPK801EKr3aW1rU5fYKfAfPKfXOXinKxbrZOJzD7GOZRYuI:1D5kC8YLZJUxYXKfXMrZO9Daa6uI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646834943, "uuid": "62365228-57cc-457f-9a8e-bb4e1e18e3b8", "value": 926720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646834943, "uuid": "41fa4735-4b34-4780-8045-ab002b0d7c20", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646834943, "uuid": "cdde1d49-b45b-421b-80f2-d632424962a6", "value": "Hesap_Hareketleri_IFT_MAKINA_SANAYI_VE_DIS_TICARET_LIMITED_SIRKETI_20220304_153829690.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb5eb906-9fc8-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646844583, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646844583, "uuid": "878dd297-91c6-40ff-ba82-e0a4b3526086", "comment": "Malware payload", "value": "1c258b617fbcff1edcae415076ed3f7c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646844583, "uuid": "61276aff-1c0f-4d1b-b0af-4c47bb4db44d", "comment": "Malware payload", "value": "c0f56862ac9cfc26231a5be9b87b8dc19cc54a62436a93a90c283ac7afc9b786", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646844583, "uuid": "1755f55f-7c4a-4cad-b4c7-ffd382189cec", "comment": "Malware payload", "value": "223cfa8d0c7e8361344b13750db470ad4431cb7e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646844583, "uuid": "50c1e321-2794-4225-88cb-c25f66dfeb95", "comment": "Malware payload", "value": "c80e2d31290506fc0fddfe07caadf0337d89da3bbda6f387e646456be25eb23a979a09d15e8812e47b1efd472dff4d38", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646844583, "uuid": "19be84b6-8290-4b69-a7f8-1ecea4027c0b", "value": "T19055CE02B3D1C036FFAB92739B5AB24256BD7D254123892F13982D79BD701B1277E623", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646844583, "uuid": "55111f9e-35e2-4dc9-b37d-d899a466952e", "value": "afcdf79be1557326c854b6e20cb900a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646844583, "uuid": "35bf9aaf-d737-4afa-b5c3-d4ac82a96201", "value": "24576:4AHnh+eWsN3skA4RV1Hom2KXMmHa84gy4PFoFfX272OVGFuUqj5:/h+ZkldoPK8Ya84gy49oR2GI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646844583, "uuid": "79ed6eed-efc3-4204-a183-ad95aced2851", "value": 1385984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646844583, "uuid": "c59cc71e-c03d-4731-a83d-3c22f5275d8e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646844583, "uuid": "db817cae-8adb-4b3a-a6d0-f31317340b81", "value": "1c258b617fbcff1edcae415076ed3f7c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a1b5ede-9ff3-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646862673, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646862673, "uuid": "97784521-8b2b-4c09-bdb0-efe85a808add", "comment": "Malware payload", "value": "2d555e17525e8129ac796a28c351f0ac", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646862673, "uuid": "56a79961-e445-4e98-b3b7-a6b2bd50114e", "comment": "Malware payload", "value": "c137afff29ec0ed2cd39d0ed830b63d30b5df0d0d7f90533aef757942442ecf2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646862673, "uuid": "acce2302-ce3e-49f6-bed7-57307138b9d0", "comment": "Malware payload", "value": "8ac7c8e19317d2b92f9a0676a73f3366bb188268", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646862673, "uuid": "7d2ae9be-c8d4-4cd0-a495-a79c507824c9", "comment": "Malware payload", "value": "75a4444cd95d5f386761a8209d233812dcca8265e46d61e3fff631e16c72d7822af27555efaa398e08d8eedc0126bce2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646862673, "uuid": "fef36831-fc7d-409a-ba55-0b7981a47a13", "value": "T1D2A48D3975808D41E5451A36D496C06587D29B8E33B3E7ADED7B03732F433AACC912EA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646862673, "uuid": "a6e4e73a-b8d3-4e43-b76c-9a86e8bab486", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646862673, "uuid": "2515b667-1550-4eab-952b-f26fe9c1f388", "value": "6144:EjuorGWVTK8Cri1DobtHOrVeQQAPbaNmUeiAgB5v/kASw+aRtq0KFjKaYlw0Vc:ESoqWVTaHYgQQAT6IzW5HL+wwWls", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646862673, "uuid": "fcf5ae54-2763-454b-909a-fa0db64187b7", "value": 479464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646862673, "uuid": "42c80190-7c9e-477a-b4ec-616eb8586668", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646862673, "uuid": "b80f8e37-86c0-4df9-bc58-c01d5163bbd2", "value": "SecuriteInfo.com.Trojan.GenericKD.39162332.5710.25971", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86500310-9fb2-11ec-9275-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1646834964, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646834964, "uuid": "5250a27c-5b33-449e-a440-e04aef83285f", "comment": "Malware payload (SnakeKeylogger)", "value": "aa8fdd46cf31469de00df5668b97a5e7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646834964, "uuid": "d81727b7-8c1d-4e13-9bab-95d195179393", "comment": "Malware payload (SnakeKeylogger)", "value": "c198130bf97753951a12eea28cc9723e844c5af38379214add110516b3c39df3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646834964, "uuid": "d92489c1-a436-40db-b6c8-3577d1e6d2dc", "comment": "Malware payload (SnakeKeylogger)", "value": "59f3e17b0418dfee8649138052938dd32a11c78d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646834964, "uuid": "157b537f-a02a-42ca-881e-dca1e08e9f02", "comment": "Malware payload (SnakeKeylogger)", "value": "3476f3f7b687301056c0d2347fb651396b84194cca02360d372ed2aee36f217cbadf0de0c92f94fdef60049bb1e50dd3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646834964, "uuid": "feefabbf-4a7d-4771-a54d-8b1506cd8068", "value": "T10F84D0479713C6D7CB1A2B3D997297141E09DF26B93987472947B8FB3D2A2CA3C980D0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646834964, "uuid": "6dacbefb-c60d-4bc1-a8e2-d1cb48cb9ac8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646834964, "uuid": "fe63d600-3282-42b2-b2b7-dfcb5af6c229", "value": "6144:PXtncUAJ4tQHIYG0WEL9/um99uf7NEaU14D7/1EKThNaS:PxcUAJQMzLIm99AKarD7/1EghNaS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646834964, "uuid": "c9902306-dfa8-4111-b50a-387c8a99bc93", "value": 402944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646834964, "uuid": "deaafbf8-bb42-4133-b410-7b58d705c981", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646834964, "uuid": "8b862103-327c-4211-a649-c3ad530ff4af", "value": "richiesta di offerta.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06f64626-9fcf-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1646847206, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646847206, "uuid": "8a138a47-1252-435a-99ce-f9fca603157c", "comment": "Malware payload (Mirai)", "value": "87a5ada2603ba68b2df7624249656763", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646847206, "uuid": "fdb1c584-7ed2-4f50-82f2-b847052524ab", "comment": "Malware payload (Mirai)", "value": "c1f69572f60ab516caf48ae523c6d1719767113eabc7a97a0f40dd4cbe5ad562", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646847206, "uuid": "8ce43ad0-0a91-4cf2-92ef-8696d47ced73", "comment": "Malware payload (Mirai)", "value": "8a1f000a10babcd05e95236ffe3597c6ae00e7d4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646847206, "uuid": "18126534-fb90-4d28-9168-aed0c2a01e63", "comment": "Malware payload (Mirai)", "value": "a882c8ad9d7ae9315c964a0662c4f9591ed995066962b9140f2729cd29285fe8ca6f015e0dd2521add8551daeee3d560", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646847206, "uuid": "9ba8a70e-e82e-4feb-b4eb-63406004cf20", "value": "T1AB232996BC91DA0ACAD023B6BD6F64EE330163D9C2DE3257DC145F243ACA90F0E67645", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646847206, "uuid": "00089ad0-3927-4605-b666-ec46a0209dee", "value": "768:1TOD91Ug/ghNHSSxyhI7QgHZqx4F+ErnZJffui95U5SpwpYWaBESR3VeeB16Y03y:wKgYjHSS0ucxUrn7bOSpwq/uGqZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646847206, "uuid": "1906ae5c-dd71-4059-a606-ba6e9a4b793b", "value": 48260, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646847206, "uuid": "b9403be1-dc06-4b4f-86ea-a8b94d646885", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646847206, "uuid": "3227ab58-b2a8-4daf-b380-52995aa13454", "value": "87a5ada2603ba68b2df7624249656763", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e31873e-9f80-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1646813342, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646813342, "uuid": "6c4723fd-e8c2-4f96-8eeb-8f227d342d23", "comment": "Malware payload (AgentTesla)", "value": "02da1ade61f66914a2d9ad1dc7cfffa5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646813342, "uuid": "8ffad381-a4f1-466f-bd3a-287735c4a9d8", "comment": "Malware payload (AgentTesla)", "value": "c20f4ba0cf487caf8c3e48495b39b9c5497166218769ccd74d8d2950c0feed6a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646813342, "uuid": "937d5327-f0c8-47bf-8b5c-9323d82f6dde", "comment": "Malware payload (AgentTesla)", "value": "921f7902d40f5665f32b36b6b033b34d726cb8a6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646813342, "uuid": "3e661b91-9efe-42e5-adb7-ad6b48e68e0c", "comment": "Malware payload (AgentTesla)", "value": "b2340873aef0289d9d629731c9badacd81722c3a57a907062e5741ec78a69b206807120034ca3b70146a2fb1c1e90fe5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646813342, "uuid": "db6d6d4f-af6c-4970-852c-d46c37896e1f", "value": "T142F43318737D13000B2AB78DF2B62ABD0614F73F8E2BB941C664E6D7266379B1D18D58", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646813342, "uuid": "735462f6-e6c4-411c-826d-3f436703ef21", "value": "24576:7YbybzQcnn0DnWgq+nDEKcesmQtZ+b3ff/AmaVNNfGlP:eybzLnn0DWg1nDyTt8L7aVrwP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646813342, "uuid": "f4fa15e4-fb97-4591-8b8a-4507f29f24d5", "value": 788896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646813342, "uuid": "4eac0a1f-94a8-4470-9d1c-6cf7709f4c2a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646813342, "uuid": "4863dfea-157a-46f9-8343-db8f37589ba3", "value": "Quote order#098799.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac84b317-9fce-11ec-9275-42010a9c0029", "comment": "Malware payload (Quakbot)", "timestamp": 1646847054, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646847054, "uuid": "2492c449-78b4-415c-aa8b-1ea18d22b903", "comment": "Malware payload (Quakbot)", "value": "f75997b5f24a8a6aeb30e280a08e096b", "object_relation": "md5", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646847054, "uuid": "5691fe65-eca8-45bc-b083-c49ad3df6bcd", "comment": "Malware payload (Quakbot)", "value": "c223b3b52da430ea8ca61a9c6594a9c814539f1ab7b91aa39c527ce9670be85a", "object_relation": "sha256", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646847054, "uuid": "c5eaf350-d559-4b3d-a5cf-421e7cbb5e73", "comment": "Malware payload (Quakbot)", "value": "bdb9a660df38472f63cbe3b3aec963e5d2b6bffd", "object_relation": "sha1", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646847054, "uuid": "27c2872d-77fb-4fef-936f-b1f6963724c8", "comment": "Malware payload (Quakbot)", "value": "5ffc98501406c37b1a63d0b3a5cbd36557f5c0309f59f5c45c515835e2b57da40c59dc2e0fe4ff7d8aea241a09b95ea7", "object_relation": "sha3-384", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646847054, "uuid": "c3a069c2-8406-407b-89ab-a66adc456d97", "value": "T1A734D092859555B6D1EEAB7033424CD181BF702AFC0AE816178353FB3A022F76D992FD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646847054, "uuid": "53a9ae56-9a01-4839-99b7-aa3ba578808b", "value": "3072:kl5YTPZav/2I01sV03b5R228Driy4EtLa/3WumKrDMzzwJS/wiv+jfcxmpOX3gLG:A5Eusjr222+yXNQ3MwwdofaVE2/YHE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646847054, "uuid": "2fd79699-fe9c-4e11-bf80-8b656fe4abee", "value": 239388, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646847054, "uuid": "43dc113e-cf70-427b-95cd-db4bf3b00679", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646847054, "uuid": "6797820f-70eb-4d85-bb57-3d2bf09b593d", "value": "oriesvt.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7717f97c-9fbd-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1646839663, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646839663, "uuid": "f7722e2b-481f-40cb-9a05-940ebbd93304", "comment": "Malware payload (AgentTesla)", "value": "49e8f31a9019c79debe37fa0f0d53c8e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646839663, "uuid": "05d93320-80c2-4390-87fe-3b53808c6acb", "comment": "Malware payload (AgentTesla)", "value": "c240dbf96185afe04014d259b3ed202d2cbb53cb634183807ba276a1ebf5163f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646839663, "uuid": "5ca308b4-7046-4e46-9e15-31efe174e9f1", "comment": "Malware payload (AgentTesla)", "value": "06426c43548c4ad5a2cc7e26dc794d9cce63de77", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646839663, "uuid": "a11da136-d838-474c-841e-da252a346e51", "comment": "Malware payload (AgentTesla)", "value": "5b5a9528814c8a9f572254795a7d1fc35db6dc4f65c555dbaa87f4372d878d84285fb1d96167b6518811167e15a5c64e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646839663, "uuid": "ea289c3d-b6dc-4325-8478-41f795c11ae8", "value": "T12B8423DA9F98913BD4477BF115B2E958EFBEC7DC21A7230B53282AE31163581899C348", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646839663, "uuid": "43ad26cb-e6ef-44f3-a98c-6ad568e87429", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646839663, "uuid": "55f3a6cb-c8e9-4a63-a204-4a4e605f60d0", "value": "6144:rGiLHYQf2XZRhEHiqe0n3zX3JICCa6bpO17cHO8yUaw7dEuApmL4WC:HHYQSXye0njnRwcqyw7dPAp3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646839663, "uuid": "d33c1f2e-fdcd-467c-b6a9-36f1353fa838", "value": 395070, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646839663, "uuid": "677574af-f04f-4ecb-9266-db430fd1c4af", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646839663, "uuid": "d67fdd41-bf30-4f89-b438-e9720171edee", "value": "Quotation#QO210421A87356_pdf.gz.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7be241fd-9f88-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646816908, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646816908, "uuid": "ca1036dd-8bcb-420e-a481-3ed5b708e5d3", "comment": "Malware payload", "value": "3a3999a3ec330e99099ad4ad44a4bf75", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646816908, "uuid": "7c7ef57c-caea-4656-b971-0037aaebbf6a", "comment": "Malware payload", "value": "c3d42a5ff6212be92ef5365a286ecfbce50b8de39afc26ef061f6e672bcad43b", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646816908, "uuid": "39378d91-d893-4805-80ae-9d1f58745146", "comment": "Malware payload", "value": "99fbd389b15cfcc9f90c50593693271fafe1242a", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646816908, "uuid": "f706879e-b05f-4f52-a734-eed97b449e9c", "comment": "Malware payload", "value": "54b07bf2637f50bfdad3612f1620bbecdb21ee46774320ef99f731fe64bd82152bf0164b8b50a3a0427510e75264979d", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646816908, "uuid": "b45feb12-824d-49b4-a41a-3d6c8870c1d4", "value": "T148B012000808537680D840C234B3432BC462E521D4BB6028184E50560D37A4701C5014", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646816908, "uuid": "a3ff179f-f831-4df9-974e-e5665fb1bf1b", "value": "3:jKMFH5K3dLEv2VMFHXA5AkmIkj/bFtDewhORv:jKMFIGeVMFG/STFtDSJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646816908, "uuid": "cee25cce-d4bc-4710-b1e0-53c1beb476ca", "value": 92, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646816908, "uuid": "218f53ec-6efa-4320-ad54-64b8d543c287", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646816908, "uuid": "99df96a8-6b22-41d9-af73-002fbf4ef978", "value": "x.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4750672b-9fc4-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1646842590, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646842590, "uuid": "bde80174-c06d-4534-9361-47fb04d8dc9f", "comment": "Malware payload (Mirai)", "value": "df325ec58456d8ecaf9f34b15eb03517", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646842590, "uuid": "4c72a659-8bb9-4d7e-b258-122e18db75fd", "comment": "Malware payload (Mirai)", "value": "c494a3f7af5bd3d5264dd9d711c51fcec2a326aa50eb2a91c9c6f0fbe0404e39", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646842590, "uuid": "e07bb0d2-1d93-475b-bbe5-26f209dfa91a", "comment": "Malware payload (Mirai)", "value": "c69d91f5dabacd7728c857ae0a11095e3be5585a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646842590, "uuid": "83a208a4-10e6-462b-ba74-738617d1e2cb", "comment": "Malware payload (Mirai)", "value": "9f98b687fd1c066136370e2ead7d941bece05f5fe162ce22fb9ae33da2a1d77f31dfb5986b0138d3fb5c767a05f038ae", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646842590, "uuid": "f7dfbebc-a1bb-4418-85e0-e8141e60d748", "value": "T133D2E13A47AA541BCEA4A1B140478FC9346D917C985CEB2FE671E58B00738143A7AF7C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646842590, "uuid": "cc8614bc-c1db-4189-addc-3e3f66934c22", "value": "768:T+pCvRz9mRR7b5aq09rLMBeq9qDM+RbCOFxnBIO:2cz94/5aVlij2LEO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646842590, "uuid": "562dd8d6-69b1-42cc-ae07-5718921de3e7", "value": 28300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646842590, "uuid": "4032c8f2-0201-46ae-aab8-272d3eca35c0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646842590, "uuid": "c5aa9289-a89b-4efe-a6dc-7d8eed18bbf8", "value": "df325ec58456d8ecaf9f34b15eb03517", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13561300-9fe5-11ec-9275-42010a9c0029", "comment": "Malware payload (AsyncRAT)", "timestamp": 1646856676, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646856676, "uuid": "4591d966-a05c-4876-9fe4-8946ca525687", "comment": "Malware payload (AsyncRAT)", "value": "977754ec875fcded4fb2a6d559c62d85", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646856676, "uuid": "25b786ec-d84b-475f-a696-2194969ac57b", "comment": "Malware payload (AsyncRAT)", "value": "c4d0b7b1d2e6ac88749f8a2ac940dadf08e139c07a8221d25194145e4a6f21fc", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646856676, "uuid": "39fdcc5a-239f-43de-b761-5cb0fce82253", "comment": "Malware payload (AsyncRAT)", "value": "63356d88c1837a29b40e1e13ee61fa8b19cf751d", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646856676, "uuid": "516c32e1-1145-4db5-8d2f-6bb69df1e578", "comment": "Malware payload (AsyncRAT)", "value": "a7110e45b1bb3927ef50c4097a89a83c0f52c8649293b4a1b0a309846851444be95cfdc36c53718a0c60a07d73484ba4", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646856676, "uuid": "a606608f-f3ec-446a-ba88-667596e96d98", "value": "T1BA54D72A22C98079DCB529BC7B3397F58BAE1C52191CD50E27817A394A7D6C17E00FF6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646856676, "uuid": "d03e8291-77c6-4da8-8ea6-914066847f2e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646856676, "uuid": "bdac9516-ecc2-46ca-b4b0-505b6e495311", "value": "1536:TuW01Toq7C2+BImxq44GbFndzmkqfdySs1ZUHqEh2kY1G/tOs:TuWgToq22+Smxq44GbF/ai1HEIkDOs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646856676, "uuid": "c6e00d5c-420c-4131-b94e-1cc8a8934c13", "value": 298496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646856676, "uuid": "5bf5749c-2697-4bcd-9ff7-3b1725710a8f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646856676, "uuid": "141982c2-8656-4da1-a5a2-09dbea7b27d3", "value": "putty.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a0d742d-9fd1-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1646848178, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646848178, "uuid": "dafd6c4f-cab8-4a56-bda2-dc6cb2f10a5a", "comment": "Malware payload (Mirai)", "value": "93b8907d2a2937c96188c346c633fdca", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646848178, "uuid": "270e9588-537b-48fd-a2a8-c9097c3ab485", "comment": "Malware payload (Mirai)", "value": "c4edf6906c5536671b4071d4ecd724dba2fc1b33dc1836cfbd7fcd734c91eb20", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646848178, "uuid": "f47df367-1b5a-47d0-94dc-4f7d91c5f413", "comment": "Malware payload (Mirai)", "value": "1aff1b4daa638947e2a5da42ba1ef28db01aa4cd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646848178, "uuid": "d6f225d4-c574-451d-87a8-3f2f76b9083a", "comment": "Malware payload (Mirai)", "value": "798f87d9deb11e349d3eee0d2f0410e3a53baada4715f0f5f68ff1d61863be9460f74e22166e432aa8a077f50b4b5343", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646848178, "uuid": "4f5ffe4b-e29f-440d-953c-ff9477b2590e", "value": "T10B332856BCD29A6AC5D423B6FA2E519E3321A3E8D1CF3217DC204B1437CA51E0DB7B91", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646848178, "uuid": "5cff87be-559b-4a6c-b087-bf64d2dc75e2", "value": "1536:tfznFR4PmYm/Y0oBsDSLRb+eADL6rL2yBCNt5sY1:1rX4fm/Y02IkvkbsY1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646848178, "uuid": "f41f0faa-a58c-484b-a2f3-91d0c101bb4a", "value": 53340, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646848178, "uuid": "59e575d7-4974-416c-9235-d50a28a60e4f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646848178, "uuid": "bd6243a3-e0b7-45cb-b97c-b75f4bb9abbb", "value": "93b8907d2a2937c96188c346c633fdca", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb97265c-9fbd-11ec-9275-42010a9c0029", "comment": "Malware payload (RemcosRAT)", "timestamp": 1646839859, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646839859, "uuid": "7268dee8-d861-4eaf-949e-852d5ad4686d", "comment": "Malware payload (RemcosRAT)", "value": "20e9c8f413ad5b4eaf1225c93ba2d1d8", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646839859, "uuid": "e431f458-1087-40f3-bc98-f7ab0996e28e", "comment": "Malware payload (RemcosRAT)", "value": "c536b84ee17abfc596058bf5aca74f161cc372669760aba80804d497bb256bfa", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646839859, "uuid": "bb981382-4d28-43da-892a-a782dc9c137b", "comment": "Malware payload (RemcosRAT)", "value": "15317f8e827b74b719ab4441a6034b581f87be29", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646839859, "uuid": "d0d4b856-230d-4ec4-a2d4-403c33214852", "comment": "Malware payload (RemcosRAT)", "value": "266f93a17ea47b734bcb18dbf79991077d87b1e3b7c5d7278197a9dad14fecf5084fa0e7b619077bf7fb650ac2483441", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646839859, "uuid": "d1f998b3-8cc1-48d1-88c6-5d5a631cbb66", "value": "T1A715AEEEB7901832C1326A398D6753B46419FE112F10A4873BE87D0FBEB55517A393A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646839859, "uuid": "bc839d6f-9936-4f1e-8c3d-80afa6463f02", "value": "9a2305e23c811e08425371fd3caa41ef", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646839859, "uuid": "d5787142-1b1a-4852-b6e0-618fbb60d333", "value": "12288:DPMS5rQMPN376hkPire9wd2rUnyMRZv5YDQfzl/WRIlRfkKOOikh:rMsld6hkie9wdFnDZv5Ymht7f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646839859, "uuid": "65a59143-5664-457b-b357-aa1dd83cf4a6", "value": 919552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646839859, "uuid": "1e8d5094-9470-4c1b-9da6-8044fc17ed28", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646839859, "uuid": "e86e3a4d-cd84-4924-bd8b-95e2b8081beb", "value": "ATTACHME.EXE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5de2226d-9fb3-11ec-9275-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1646835326, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646835326, "uuid": "f50fd184-61a6-4f58-ac68-fc79d5319b4c", "comment": "Malware payload (SnakeKeylogger)", "value": "f558c9188b71a3c4fe44b65dfd665139", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646835326, "uuid": "ef3ab5bf-988d-41f6-a004-b86a8ba81774", "comment": "Malware payload (SnakeKeylogger)", "value": "c588dd15ae5fe13988410af0743c45fdc11d6ba4740e106d8ca1e9c5f15d5584", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646835326, "uuid": "e080fe19-6e80-4c70-bc43-f4e405faf72d", "comment": "Malware payload (SnakeKeylogger)", "value": "18d2648531de23ade692702a393292029ada4d2f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646835326, "uuid": "4fe328d8-c83e-4a36-9573-82c757a80510", "comment": "Malware payload (SnakeKeylogger)", "value": "2c37d1fa7f5355a780cceaca87cd2ad7952647bf89ae67ba403700ca11a1681695a6f4673bfd5bcee108189389fb85e7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646835326, "uuid": "4b797b3f-3c6b-43da-8c8a-edcdb91bb280", "value": "T1CC25CE10E96A503BE2BE8A791BC5F86709D7BD661104E1BE2C2CF64A0FF153D9D81C32", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646835326, "uuid": "e53408a9-54eb-4c57-aa7c-4a9c8a63de28", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646835326, "uuid": "0b02d9fd-727d-480f-a74c-62b2474da15d", "value": "24576:rrzfx6Bl0arw3ovre9RYdJkH+vuM/zOJjg5+EG:f96BrCIrWRkqH+vuMejg5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646835326, "uuid": "1047f098-2cc6-44a0-88c4-7957194c53be", "value": 975872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646835326, "uuid": "9db163e5-e6d4-4fe9-b24d-c5a6677cdde9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646835326, "uuid": "b50c59d1-1cb8-4ab6-a0fc-77484494e4df", "value": "ORDEN DE COMPRA (2).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66220d00-9fb8-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1646837487, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646837487, "uuid": "3b9d285a-31f5-4a12-9974-fffae150b916", "comment": "Malware payload (AgentTesla)", "value": "705b081851b7b0c9397737a7a493fb51", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646837487, "uuid": "2e8174d2-61b2-4813-abfd-9d648444b224", "comment": "Malware payload (AgentTesla)", "value": "c5ad98759361ec1334e48e97867a163835806360d4f3be7bf68e70ece3f80bee", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646837487, "uuid": "d848a894-a91a-4d64-a169-e159dd28f55a", "comment": "Malware payload (AgentTesla)", "value": "678753f09a4fd0b172ae6712c2b58e0646442cbe", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646837487, "uuid": "16c4f671-c71b-4ad2-8f86-6fecc3e79cf6", "comment": "Malware payload (AgentTesla)", "value": "d00d8cff9a703c171a3ad203bbab283fd3d72b74c7bad356ced4c279602f8f0b37d49b2c2bd5b7de6f5d8dee4bb51ef1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646837487, "uuid": "f759c1bc-b225-44ae-8a83-fcad70a48314", "value": "T12DB423BD43FAE91729910630CF08373315A6204E67BA16C9C84A634C56FDCEBD6DE4DA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646837487, "uuid": "07f4aea6-5e8b-438c-833d-c4776b2b677b", "value": "12288:srnok5D/SyGVsW58dNyHpEuJmi6MR0bTeHEdiT2R+2qOLRfB2rdqfcNfXn3u:srnJ9G15diDzTeHit0udMrdqfclO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646837487, "uuid": "9f6e07a7-eb4a-430a-9033-2179c32315eb", "value": 538114, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646837487, "uuid": "44b9782e-07f2-4986-91dd-e42bfec7d561", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646837487, "uuid": "0bfe1712-00b7-4198-b52c-0ab021c8ca42", "value": "SOA.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "486d76f2-9fe7-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1646857624, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646857624, "uuid": "ca9ab8c0-7fa9-4666-9b7d-cc4c8b5fc6c4", "comment": "Malware payload (RedLineStealer)", "value": "cbb2c650c56dd4fc51b51e7cb0d8cd74", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646857624, "uuid": "2a08b72a-a762-4ddb-8a49-02dc5a1a0beb", "comment": "Malware payload (RedLineStealer)", "value": "c7195c3547ca99e4f31e2154f3194bd3e90bac994a2d26d7623c3bb1b5822bd0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646857624, "uuid": "02bf5b00-4f62-4355-92f4-bc6ac599a2c2", "comment": "Malware payload (RedLineStealer)", "value": "a5d8e6aadaef855d861ab3d9c659c458066376c7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646857624, "uuid": "f7696025-f0b9-4bff-a8f7-431e52618b8c", "comment": "Malware payload (RedLineStealer)", "value": "f70fc702028a4ef1d1ffcff1f2e6f1f8369119df041a4095228078f0594d807d8454494b8deab9907da1506c55a2ab69", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646857624, "uuid": "a6f1e47c-c62f-4da9-9167-a877c6c27133", "value": "T186353322EB0F02E6C76149F2E51D418114FBE09D9AA45319BF78B33ACA3D507F64BE49", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646857624, "uuid": "a60b4328-dff4-4424-92f6-b29ebcdedcd1", "value": "f04869e37d58c16630e36a59859a32ab", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646857624, "uuid": "d7555ac3-865c-4a44-b455-449ece2f489d", "value": "24576:sstSAoW9qoDSvCls2jDEcNRo8L5oQwPH/yEm:7yWHf9DDNRh5T2yE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646857624, "uuid": "acf3a738-e19e-4eee-aaef-9944c39ddc87", "value": 1129776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646857624, "uuid": "274fc4aa-4834-4ce9-9d5a-873a167dfbcf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646857624, "uuid": "d70ce856-d63e-460a-b059-55189511b1a2", "value": "cbb2c650c56dd4fc51b51e7cb0d8cd74", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d9004df-9fcd-11ec-9275-42010a9c0029", "comment": "Malware payload (Quakbot)", "timestamp": 1646846385, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646846385, "uuid": "48d88414-970a-4141-ad3d-f9266be2ef40", "comment": "Malware payload (Quakbot)", "value": "46c00db2bbba350b698dc540344a0a83", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama164", "colour": "#6C68A0", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646846385, "uuid": "e51a575c-d95b-49c1-be92-6c6f0db3c9d0", "comment": "Malware payload (Quakbot)", "value": "c71a24c7ecc4fc745cdd9bcc602c6995113a19221abbacce72df070b6b2052f8", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama164", "colour": "#6C68A0", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646846385, "uuid": "f9099d75-5414-4421-b566-7a34ef3e836a", "comment": "Malware payload (Quakbot)", "value": "122a009ff6fb94537afa9caccaad3fee29112cd9", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama164", "colour": "#6C68A0", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646846385, "uuid": "3650e022-e8a4-492e-839d-248ed04508c1", "comment": "Malware payload (Quakbot)", "value": "ac983c21559feb1f1d7d4afffbe5647a34952c852835460451900db2d80ed12faf7e60b7e09b5855d9b3fec961941a3e", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama164", "colour": "#6C68A0", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646846385, "uuid": "e93781ae-a710-4f1b-a463-89f1eab7fe36", "value": "T127657E23F2C1887AD4761A3C9D1B739998BA79112D28F4C77AD44E8C1F37A433666393", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646846385, "uuid": "cd04be44-17b0-4e24-9c3d-fd2fa3e780ff", "value": "cf78a88c4b0403a976a85038ec51a351", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646846385, "uuid": "ad7bf5eb-1d80-4e80-9b5d-1b872b08489c", "value": "24576:LP2GXxd5hyXOZk/R8SoMbEYN54UUrW/tRJfJcOIU2SAHl4XoWSIgX4T:Lu8jI6kcYN9RciKKgX4T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646846385, "uuid": "42f9f526-7d2f-42c2-ac95-d136a2a1f3c7", "value": 1502720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646846385, "uuid": "ec48a6d7-5507-486f-a08e-2a33d29cff86", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646846385, "uuid": "20a71bb8-ad1a-46bc-9125-d803099e41b2", "value": "6520804.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fcff8641-9f8b-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1646818413, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646818413, "uuid": "3f3573cf-0a38-4418-b42d-3c3b64f54a6b", "comment": "Malware payload (AgentTesla)", "value": "f62c22ec0526fa45f5ec84ee3b0563ef", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646818413, "uuid": "95b90dfd-e51f-42d9-88f2-62eb7dd70925", "comment": "Malware payload (AgentTesla)", "value": "c7227f6b5ea0f5ce3e26cb76be74eda9d5ee1b2e25eef273e13badd0471a32ef", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646818413, "uuid": "f8ed1aab-f236-4e85-acbc-a51305d13bc2", "comment": "Malware payload (AgentTesla)", "value": "fe8f1b604c0f750a51844f5b95c8b10718cfb2e3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646818413, "uuid": "a4794d0c-33bd-4d69-bc04-bf01ed121004", "comment": "Malware payload (AgentTesla)", "value": "69802bf3427ba5567ee2d931c819162119a14c5d1859ea6d7fee4e49c78391849472549ebef957df80a1883773077c3b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646818413, "uuid": "1576d44d-f823-4dee-9b22-5192c58adbe3", "value": "T162B423B05F38E57ECB52A971DA3834A9E79538EB64C5C37403332F099BB19A531E910D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646818413, "uuid": "7a1c8723-a850-409b-9117-db0adb362790", "value": "12288:vy4PFe59wQWAwinsJg9qbpmLkhmRjkA+c6JY4EN:lPk5+Q3NsJg9qdAkhmOGWEN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646818413, "uuid": "416cc976-255a-4ce0-8bbc-777c49652f89", "value": 499839, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646818413, "uuid": "bc3c0ea7-6c10-4915-93c1-c415906d091a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646818413, "uuid": "7db4cdfc-33f3-4567-9a73-9d377c58c437", "value": "TELEX.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7123272-9fc1-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1646841489, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646841489, "uuid": "32e608af-2219-485d-9128-59ba1b5cc36c", "comment": "Malware payload (Mirai)", "value": "1744afa2f3adafcfdbca61e750f1d349", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646841489, "uuid": "833a58ee-21fd-4367-a18c-b37a936c9912", "comment": "Malware payload (Mirai)", "value": "c72e47a2f21ea60899bd5c61c9d0ea115cae93aa7572bbeff0344f64bd8fdb00", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646841489, "uuid": "8aecb5c0-237c-418d-a723-ea8cd2db1a6a", "comment": "Malware payload (Mirai)", "value": "8abba07ce24b32a4d2403a8933501b4c3143d553", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646841489, "uuid": "5d70594e-b97c-41e3-bce9-c3f61fc751bf", "comment": "Malware payload (Mirai)", "value": "0b7eeb924d6845d73e3e51eba0988f61802226625d00fef4f311d6204b2e5c958a641e80b85b263902508069d58f171c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646841489, "uuid": "59b312a2-3e71-4789-bb10-7973b6d495b7", "value": "T16CF2D152E1D9616BC4DD45344ECE6C0F7978633A85C14A00EBB8267B0AB3B683B2439F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646841489, "uuid": "667b99fa-f37b-4711-a991-48aee15337f5", "value": "768:wtn+9TuBuaqQv/I2vEy9/ZOyiP4+qaxXKzNvyhk5fVnbcuyD7Uiyqo:Un+RulzPEk/cyLQ46k7nouy8Zqo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646841489, "uuid": "f9ed09e6-9c89-4718-9b63-d2ddc581efe8", "value": 35008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646841489, "uuid": "464b4403-7fa0-45de-9f76-96f52328d31d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646841489, "uuid": "ff7ac3c6-b9d5-4671-a633-c2bfec1ec437", "value": "1744afa2f3adafcfdbca61e750f1d349", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1121ec92-9fbc-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646839063, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646839063, "uuid": "de4ed1ae-214f-4ba4-acda-a49064981882", "comment": "Malware payload", "value": "219bf08ade5d33c5d753cadd4b7608ac", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646839063, "uuid": "9c83097e-fafa-4893-bb80-2c45bc54a658", "comment": "Malware payload", "value": "c73727a59abf1e651fad4baf0710cd6b62e6ca1799d69a6b539a34229778d1ca", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646839063, "uuid": "105effbb-c511-43f1-8d15-c78e92493026", "comment": "Malware payload", "value": "1849de4f26a7e0140d713392786264e451b459c6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646839063, "uuid": "c2128574-3f85-45f7-8341-7ae19fbb9799", "comment": "Malware payload", "value": "7ef98f3d962df53bb828cfdb5158a1d2cf43e1b9e8ead1ef81e63c873fe18c14f3312e61b0ca829ac3fd80853a9a8d36", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646839063, "uuid": "ec6f9bbf-0f60-4040-8531-01f66421ec91", "value": "T1F6D1942AA3D89637CDB64B3358A362500679F784DCA79B7F748410365E963280F62B31", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646839063, "uuid": "f4f48df5-0bd4-4659-b896-e2a0be852ad3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646839063, "uuid": "1d9180b0-1254-42fc-b665-0bb6e3f0d52e", "value": "96:9becbqIXlMrN2mIG3nCKeX34fpQtRjERidDNzNt:96uKRI4beXoynjEin", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646839063, "uuid": "b2dde4e6-61fb-4372-a29c-4462fd34401a", "value": 6656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646839063, "uuid": "154088fa-42f7-4b66-9142-02780557e490", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646839063, "uuid": "702ece73-0751-4e0d-a710-053defdb3d5f", "value": "219bf08ade5d33c5d753cadd4b7608ac.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a419088d-9fc1-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646841457, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646841457, "uuid": "88ff9592-764f-4bd1-8f77-88b747cb183d", "comment": "Malware payload (Heodo)", "value": "4c13e0a6dd2feb890623230596dc29ce", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646841457, "uuid": "f839055e-a364-4a1c-9029-e28ff2f62db3", "comment": "Malware payload (Heodo)", "value": "c8256e306d79dedc1d608a087305793b59b0adb6acc97af57cb27d5fd98766bf", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646841457, "uuid": "5b9f0719-67a3-4cc6-a8e5-fb6a5f8182e8", "comment": "Malware payload (Heodo)", "value": "47f1110186990cc18c5ad194cb700140b574a716", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646841457, "uuid": "762d05f8-61e0-4f12-94da-c99f2917b2e0", "comment": "Malware payload (Heodo)", "value": "a09832e0760be0c3379ce031d54eea4347173c78cf03c8af5eadae03d95af8c80412579d1db0d2bbc295fa372390a3a9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646841457, "uuid": "689a188d-a8b7-41dd-a823-47ffae21479e", "value": "T117257C107E8A817EC71B85B30836676D6FFEAB204B6CA1CB478175ED2D316C29B36705", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646841457, "uuid": "0bcb374a-390c-4372-8353-ad6870ad3a89", "value": "087c9809507dfca4c3283e6c7539e91c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646841457, "uuid": "b2b3bf9c-3003-48a3-8e18-e0adf42f8db9", "value": "12288:cR5SOyRHiA6m0OcEldzt6JtcS1j2xKkr:cR5SOrKldzEtcK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646841457, "uuid": "571d0a24-55d8-4785-a584-c7251a38135c", "value": 1040384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646841457, "uuid": "62466fba-43ff-4c74-92e3-6842513e4de9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646841457, "uuid": "8391ba71-149b-4174-bdca-76e8d5729979", "value": "4c13e0a6dd2feb890623230596dc29ce", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "068f3f56-9f88-11ec-9275-42010a9c0029", "comment": "Malware payload (AsyncRAT)", "timestamp": 1646816711, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646816711, "uuid": "b3161cf2-2df7-4a3f-8750-06a6933d7751", "comment": "Malware payload (AsyncRAT)", "value": "1f5f749d5625b8cbeaa35b8fd9df5f46", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646816711, "uuid": "b7a61b0e-518c-4390-bc92-fc18ecb9b441", "comment": "Malware payload (AsyncRAT)", "value": "c839926945c2bdd51f98f6a489e6fc9b6c64b2ea629ba71709189934cc06019e", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646816711, "uuid": "1a595890-4bd3-421a-9a49-a2bca36c72ae", "comment": "Malware payload (AsyncRAT)", "value": "61af8ab31a69909f8832b15dcfd1a368c5b083f5", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646816711, "uuid": "0493648b-5df8-48ce-96d9-2e096745fb73", "comment": "Malware payload (AsyncRAT)", "value": "ef53e35918b7b0b030ea3c875f137ccf7774c6fafdbcfe8cea3f9bdb69e7b674f1a923dc1ac964e5d1290c70580c7002", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646816711, "uuid": "46d45579-3091-462e-8f20-ce111e7968e3", "value": "T148448E310EA1FE52DCA4973514A97E041E83FB5229E0EE42B79D98DA53C9C8051FB74F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646816711, "uuid": "760056b8-2220-4ece-a4b8-93f16c7fa89e", "value": "3072:FzO2PYKSjQzkLGJBzO2PYKSjQzkLGJBzO2PYKSjQAQ6QIQ7QFQWQgQdQ9QCkLGJ:A2PYKSFLGJ02PYKSFLGJ02PYKSMLGJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646816711, "uuid": "b4671ec0-f694-4e20-b33a-28255769475b", "value": 276480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646816711, "uuid": "45a2b309-05db-40b6-a660-9cd1be65471e", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646816711, "uuid": "3c75155c-9daa-4c43-a1fe-98175a56d465", "value": "qr_thailand_pass.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2245396-9f86-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1646816140, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646816140, "uuid": "db6a79ec-4272-4e6c-8248-bb0ed24ec052", "comment": "Malware payload (AgentTesla)", "value": "076f73505edfa3cd5a1455d370d12a34", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646816140, "uuid": "2a1ad6a3-97f0-496b-9397-84680db661cd", "comment": "Malware payload (AgentTesla)", "value": "c8c96d4399d9d0994e36331d821034a02b8c12489e6d7108ad061e741b706deb", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646816140, "uuid": "2491a64d-97fb-4d57-8c02-12cb4117f575", "comment": "Malware payload (AgentTesla)", "value": "093201639cdf873fda1c66c449d5b7926c897dde", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646816140, "uuid": "982c4def-4244-411a-bfaf-4eb31667fd4f", "comment": "Malware payload (AgentTesla)", "value": "87128fb94acd082eb3784fb8a8e7435192a5f952a47c35da9518a9fcb7a1cbb60347a2ff856eec32cf698baa48ccbe69", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646816140, "uuid": "546a9238-f329-4c42-81e4-3f790f750db7", "value": "T1FB84238891CBDC503375BC6E0F5BFBD939C89F8E5A05FA6A022DD5E0266E8597402CE4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646816140, "uuid": "75b9e73a-cc8a-4ac6-8427-06a55564ca3d", "value": "6144:2lfBEWTg+RW8NnjMXdmhtF/6WLFq8188A+BiqcDZ6psVC/oj2cKS3m34bJSN7+sS:+fBTTgXdM76WpqoViqj/ojFKFVo5iCH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646816140, "uuid": "153802ae-eefc-4974-8400-62e764eae6c7", "value": 403580, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646816140, "uuid": "deb16090-8732-4144-96a0-1a8621a17c46", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646816140, "uuid": "9a1593df-3db9-4469-aa15-c21e51325752", "value": "TELEX.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "774744af-9ff4-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646863286, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646863286, "uuid": "9d4cf124-1343-4598-b174-b775357b341a", "comment": "Malware payload", "value": "52decbcdf96d8c12476bb30fbb5b4cae", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646863286, "uuid": "6126272f-4988-4beb-8699-389564a7544d", "comment": "Malware payload", "value": "c921fbd6370ff582576be23c6bd4e122fd2e4d743c014b41201a6b1b3f3a4521", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646863286, "uuid": "8dfb1f35-8923-4aba-855f-9feb1dc35c07", "comment": "Malware payload", "value": "1b772f41e58a665cdb83b87e562043b791bc7432", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646863286, "uuid": "7553585a-e9b8-4ca5-9a46-dc526e997595", "comment": "Malware payload", "value": "24a30d43d82a2aa07cd1c34527f9f269b9c9ddbf418215976f850ba5376e88550c21307d7619a04e8273ea0c0eaebf4d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646863286, "uuid": "e952a4e9-6bc7-45a1-8220-d3f1c3f1a9f5", "value": "T17015BE10EA6A503BF27E9A791BC5E9634ADBF1B61604E1BE1C2CC6490FE193DDD81C31", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646863286, "uuid": "5a3a21ce-6488-4233-bc35-2e96144eddee", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646863286, "uuid": "c2eab6cc-5e50-4dea-ad60-489e0b41581c", "value": "24576:xpffbAz9H3Yg36J16naWCmzpfxwMlCx5UMLM3E4vWB+gn:xxbABH3YgqT6naWCmzpaMS7M3EIWAQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646863286, "uuid": "3bbb7d9b-f6b0-4471-8eef-1c2c9305fb72", "value": 927744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646863286, "uuid": "59e6dccf-0ee4-44e7-80e3-06d104656c89", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646863286, "uuid": "4f30c566-f2e0-4ad5-9a2a-4d6c4120f368", "value": "52decbcdf96d8c12476bb30fbb5b4cae.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7cdc2b69-9f75-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1646808749, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646808749, "uuid": "5b4bb38a-cde8-4e53-9f4a-44a0db4f889d", "comment": "Malware payload (AgentTesla)", "value": "8bdb75ae9a45dce002783325f106e421", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646808749, "uuid": "06a24a2a-125f-4d7b-9f09-60ba17bdbba5", "comment": "Malware payload (AgentTesla)", "value": "c924fc1e1e5a0904c3d43bf5bcd7f1fcdcc27ee166a5e163d36ed64b04d7d89f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646808749, "uuid": "73c2456f-0172-49d0-b6dd-db646c3ce14c", "comment": "Malware payload (AgentTesla)", "value": "20be54780df79f022b8e4e0603bc7f35fc619e11", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646808749, "uuid": "f9e6fdf5-86e7-4e12-b386-f67712f516e6", "comment": "Malware payload (AgentTesla)", "value": "b78c0d6ced5ef1cb8fc6d08737c5038fa35ed5c995b49ab82f8781787349e3204bc80363e5c33c02b930caee6e13bb8e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646808749, "uuid": "d075e8ec-2a1c-4d2c-805c-b0847316695c", "value": "T1E435AEE229EB501DF377ABB16FC8F8CE986AF973161A30DB11920B768523940CD61735", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646808749, "uuid": "a36f3a89-1d30-43ae-81b2-4fd619e40315", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646808749, "uuid": "b60a6108-8394-43b3-a586-a670bdb8ebd4", "value": "24576:XD5kaFD2wR0XIh+zwkDDDgwWahrObihtdnczpYYc44+:XD5k6D2204A7sjERdn0w44", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646808749, "uuid": "b682940c-d204-4661-b1fe-903cd008b35a", "value": 1106432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646808749, "uuid": "e7b02fe1-51a0-4666-9cdc-b1f92cb9b040", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646808749, "uuid": "8449f99e-c3fa-4066-be8c-9bba402603dc", "value": "8bdb75ae9a45dce002783325f106e421", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79d9c482-9f75-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646808744, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646808744, "uuid": "27470483-7433-4e76-aaa7-e60d5ab5b62e", "comment": "Malware payload (Heodo)", "value": "0b959ad510d019d49beddb0943ee9708", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646808744, "uuid": "3a0926a1-0e3a-4a5c-b8e6-cc7281048341", "comment": "Malware payload (Heodo)", "value": "c97b71ffc730ab552a4e5ee4b55bbea506e01fd96ad4f7fe8a8d292f942b4123", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646808744, "uuid": "0681cfef-c10e-449f-85ef-76d38ba9b8a4", "comment": "Malware payload (Heodo)", "value": "585b82b865093103e7d7de701535cc282505f1ad", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646808744, "uuid": "03d44fe2-5857-47eb-a8e3-c3fa5f69ce94", "comment": "Malware payload (Heodo)", "value": "44307a3e5187e786507e034b6e33a80cd9b1da3751ff0b1c39e9fdc35f35e0bb3e63126b61ddbce84f93f95e52d58ce0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646808744, "uuid": "51e2301c-6b62-498a-bf61-bbdb1a9cca56", "value": "T180B44C22E151E0B4C21744360607737DE60FADF01B95B277A3B015AFBAB5E71EE26326", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646808744, "uuid": "8d6d6fc7-bb47-4e72-8949-5bc92fe6992c", "value": "c354d2e1bcc359dcb00a22865c038d4a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646808744, "uuid": "7ec9493a-5663-42d9-8ca9-c682d8a659c4", "value": "6144:TMhEi6lq1EvTzbQJqnoibRcJQfTfsZsIhzED5TJycXo3ZqdK/J:hFGibRYQr8koko3od", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646808744, "uuid": "14231aba-a0e6-4a0a-967f-de15f70223ed", "value": 507904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646808744, "uuid": "d5e4190b-6ddc-42a9-9366-9f6702bc6bec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646808744, "uuid": "64068566-7788-4245-bf14-fa98b349c446", "value": "0b959ad510d019d49beddb0943ee9708", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f111007-9fc7-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1646843918, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646843918, "uuid": "cdfce390-51ef-4ff1-bb2f-9a996a5173f5", "comment": "Malware payload (Formbook)", "value": "01ff1b3d61979e39d445833f8d85e443", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646843918, "uuid": "c4a5b821-91a4-45bf-a8be-f4216e2acbc6", "comment": "Malware payload (Formbook)", "value": "ca53e5b8d2616d5a4737aaa1d7b0dc116f3133704ddd6d7f5f5a2075f4d3aa38", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646843918, "uuid": "e761194b-4830-4214-8deb-881c2fccfcbe", "comment": "Malware payload (Formbook)", "value": "1347e8821577ee0a021ad666f627eb30a77bb83b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646843918, "uuid": "5e98fa06-4568-418a-9713-13118f14bb7b", "comment": "Malware payload (Formbook)", "value": "a5616abd972eab37946e0803bf7b26ac78fd0679a5a4fee8495d3ee4c98450690a8150814396193cb514fb61eb9bbb0b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646843918, "uuid": "f24221ff-63f4-48b7-8fe0-e41bcc2108dc", "value": "T14BB4F7AFCB1B2A8AD4F928F5C27F76D296CC43D5A9390BC1E2011B72511DB99BC43247", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646843918, "uuid": "07d2db40-35d5-45f2-ac48-d92bec4183fc", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646843918, "uuid": "59caf32d-70a9-432c-90d7-d21fa5f1f2f7", "value": "6144:CGiT6z4NKoCwrkQ8xvdExPafP1jGivpMaU3vDxtrbGJQYt1ZUqFg:nz4YolEFWa1LvpQfTGm+Z3g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646843918, "uuid": "5547ddba-c100-4d06-8725-b26a151a464d", "value": 507072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646843918, "uuid": "02115096-89f5-4f15-908a-0561efb75e7e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646843918, "uuid": "9b30bc3d-003a-4b8c-bb76-9be98f880ce6", "value": "Inquiry-00221.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b4e6328-9fb6-11ec-9275-42010a9c0029", "comment": "Malware payload (Smoke Loader)", "timestamp": 1646836503, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646836503, "uuid": "e5b991c6-915c-4a16-8a88-1f409640d66e", "comment": "Malware payload (Smoke Loader)", "value": "efc853602ec16d3793b914bbbc7b41e4", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646836503, "uuid": "17286cea-e22b-41b2-919c-fd7acb506dbf", "comment": "Malware payload (Smoke Loader)", "value": "ca67ebf2b5f829924ad4eb6008250b8afb97c559f79503b98d118f669537df6d", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646836503, "uuid": "7aba4f13-bf0e-47ec-a3ff-8d25f1537eb7", "comment": "Malware payload (Smoke Loader)", "value": "185d432381f57dab446c793ec4c15c1d7f1dd818", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646836503, "uuid": "5ddb47cb-f374-41f1-bf57-ba79248e8864", "comment": "Malware payload (Smoke Loader)", "value": "35594719bc74fe7a374969aade553359842cb522665c220ac228021118ed2577d3c782d3a7f6699797ef0e8c3b1b12aa", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646836503, "uuid": "74946afe-98af-4ac2-870f-8010b06730de", "value": "T1EA44AE713670C471C0561E309415CEE2DA7EFC3179B5860777A41B2EAE32BD2AA6A34F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646836503, "uuid": "8210a56d-9b47-499e-b929-5ac1f8b5de04", "value": "120d5f35bf3d408d95409773c543e6cf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646836503, "uuid": "d3a09ae6-3f7d-437e-b0a1-22bbb74cae9c", "value": "3072:KkKITuLBGutex7e0o1M3uFhaod5gVM/h37Y1aUQ:JTuLsuMM0o1M3NZVa8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646836503, "uuid": "1bd7f5f5-5b8d-4e96-849d-e8aa9707b863", "value": 274944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646836503, "uuid": "f33b05f3-4f80-4677-98f6-0a52cb2fb134", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646836503, "uuid": "77ca08b8-a763-4fd2-955b-9d71abf101cf", "value": "efc853602ec16d3793b914bbbc7b41e4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f803af7-9fdc-11ec-9275-42010a9c0029", "comment": "Malware payload (Quakbot)", "timestamp": 1646852965, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646852965, "uuid": "2f047c93-28b5-4a79-9de4-b0381108bccf", "comment": "Malware payload (Quakbot)", "value": "17d7b2984ab07ac777095b29695a2253", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama164", "colour": "#6C68A0", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646852965, "uuid": "1b10da60-e8b9-4443-ad6b-b03037f83b71", "comment": "Malware payload (Quakbot)", "value": "ca7e6c2bc48d7f46ba6cb9f74e5e6cea52ebc2383b1e5582691b0ebc7a28dfb1", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama164", "colour": "#6C68A0", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646852965, "uuid": "f32f0ec5-1fc3-4750-82f9-3a47d4be405b", "comment": "Malware payload (Quakbot)", "value": "059095736b676039be7826620421cfabbf8f3c71", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama164", "colour": "#6C68A0", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646852965, "uuid": "16004bf9-3951-4bad-86bc-18b38b30d911", "comment": "Malware payload (Quakbot)", "value": "347cc6811ccfdca3230dc33139a061754a15d71a7aa0e4bea3d76148944677bad3d97a70baf5bf3e54f6250401bd6ebd", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama164", "colour": "#6C68A0", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646852965, "uuid": "7c11c040-0e82-4830-aef7-32c0d6e8592e", "value": "T178657E23F2C1887AD4761A3C9D1B739998BA79112D28F4C77AD44E8C1F37A433666393", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646852965, "uuid": "fb89604e-4a83-4ee5-ab8b-99a9b4fec25b", "value": "cf78a88c4b0403a976a85038ec51a351", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646852965, "uuid": "7c9254b5-339f-4a7e-a9a4-1fd084fb0e19", "value": "24576:LP2GXxd5hyXOZk/R8SoMbEYN54UUrW/tRJfJ6OIU2SAHl4XoWSIgX4T:Lu8jI6kcYN9R6iKKgX4T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646852965, "uuid": "6dd6f3ce-914f-4d43-8872-3cb4f75f8844", "value": 1502720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646852965, "uuid": "63933415-b666-4521-872f-b733f5caea77", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646852965, "uuid": "eeecce78-3dbc-4879-9e61-cd27a6b8456d", "value": "6208039.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40cb1e6a-9fd1-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1646848162, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646848162, "uuid": "3c0bd5f2-ae5b-4f24-b765-bb1fa8369ea5", "comment": "Malware payload (Mirai)", "value": "1c37756c94cc05095183326ed0cb407a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646848162, "uuid": "d065b7ac-f186-4d5c-aabf-52cb3f12ef2f", "comment": "Malware payload (Mirai)", "value": "caa79bdaaac0fbf9be47f0aaad7ae55ba29bc92b696dd972697d9f139dbc0591", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646848162, "uuid": "8f409b8f-37f3-462b-8c34-937e078411be", "comment": "Malware payload (Mirai)", "value": "32cb9eaf5d151c4eff9431af438436adffa9f783", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646848162, "uuid": "282b6d48-776b-4299-9305-20d369a51634", "comment": "Malware payload (Mirai)", "value": "3f4be3c5e502cfc3d440bfdcb4261e2eee8a92c9ac903ed3409dd40076fc68147cad17b11a989001b166508fe8ee31a7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646848162, "uuid": "b6145f63-cef8-4760-b5a5-b8f8b9206db0", "value": "T1A1436B0272280A47E1525FF4393F27E083FEE99121F4F5892A0FDA464276F77158AF99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646848162, "uuid": "724a12e2-d83e-449e-95bf-60fd94b601cd", "value": "768:UYfPffzWfQuxL/j4oy9RTcEYyrm/EkCx7qn5yQCGEgvM3f/3UaXtZAIsYspJxNE3:UUSfVj4oKJryE32yQTJvM3fRDDsnxm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646848162, "uuid": "36f91d30-0fd4-4881-b3c7-e0daf3a7a140", "value": 58284, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646848162, "uuid": "1c9438aa-8fcb-4424-a60c-20ecd000c12e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646848162, "uuid": "e2be81cb-b4e6-4c47-88be-cbba4af4dee4", "value": "1c37756c94cc05095183326ed0cb407a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9322badd-9f9d-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1646825966, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646825966, "uuid": "22f2f645-c413-49f9-9ed7-d001676e308f", "comment": "Malware payload (Formbook)", "value": "5a52c49840e8050eb943a9f1a9298432", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646825966, "uuid": "ea0e7414-0116-4546-afb6-90a7edc9ad9c", "comment": "Malware payload (Formbook)", "value": "cb8363255a0f5b3e427e0bf41a7cb19a76e45be93ab7d891daeb131ed3e15007", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646825966, "uuid": "7a091bf9-6cc4-4fea-a355-43b5181e0a58", "comment": "Malware payload (Formbook)", "value": "2e1ae4d7d3db7a88214c821f2f43146fbe2fdbe9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646825966, "uuid": "79d9d762-a888-4980-b6a3-9d829dd07a8f", "comment": "Malware payload (Formbook)", "value": "34355899073b7e42a3f081421f2b57881df3b67f7c3ee47d0992af02df58a45c5eb56906f962b42311f0a666bd68420c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646825966, "uuid": "4089066d-1e76-4a80-b3bc-89cd8e4baa7d", "value": "T18D257D98779C1686EFB11AB15CB650113D253B4CA4FDD12D2A8EEA48F1F3E60887436F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646825966, "uuid": "03496819-c273-483b-8407-0ac53aca03fc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646825966, "uuid": "7dbb7c73-efe8-416e-a557-a74e84234ced", "value": "12288:DPaHiCYdh+Va3MrE0aVnheNWmSUGeeX8GKOUJbmX1aAYzro+huvz7HTJ1LDkP5mL:raHpA+VuMwPxyX+hti/b/lTDlWp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646825966, "uuid": "b58d3849-9084-43c9-92a0-39d2e4c79363", "value": 1049088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646825966, "uuid": "e04d6370-99c1-400a-9bb6-b10c69437ee9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646825966, "uuid": "b3bfed97-9954-415c-974e-2990383a26a2", "value": "SWIFT 103 0002722221.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a48af31-9faf-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646833468, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646833468, "uuid": "81eab559-ef63-4c8d-bd82-ac0b7859e119", "comment": "Malware payload (Heodo)", "value": "d967519594d2f37e7fdc9052d749f6e6", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646833468, "uuid": "a1b1fee0-35d1-4492-a8b6-85ef018d85d6", "comment": "Malware payload (Heodo)", "value": "cbcfd8ca0657b02faa461478d02666dad7e9dfd6609c354cfa58dcf394e56a0d", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646833468, "uuid": "cbb92077-c513-405f-80de-38ff5f9e9f5d", "comment": "Malware payload (Heodo)", "value": "b37887f309de06db6cc6bd4ec329f449b075a88f", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646833468, "uuid": "188d45af-0e49-41b9-9781-4a277846faf1", "comment": "Malware payload (Heodo)", "value": "418f492ed8142c397ca85090acdf9b4bd4fc72928b9d6e0da7f38704b598fde115453a2cae1cf03e1024ad6d551b1b74", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646833468, "uuid": "e6754b83-4bfd-45ba-8f7e-70dd646fc7d5", "value": "T189A4E6197B918F7AFC5D0170A8CC8B796995E83B4AA08F026FD2DA3ED9F71434D18C46", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646833468, "uuid": "11875f83-89d2-4db0-9171-5c8763cabbf5", "value": "e140b4188c69c3bb4852b94813f9ec7f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646833468, "uuid": "c90bbb1f-95b9-43b5-b046-a530cd391fa9", "value": "6144:KfUdJ9dhe5HjGo3OvwX0ddpgqjlfBtAkIeTIpkHMPtdd9:aA9e3OrvpgqjtQFecW6dd9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646833468, "uuid": "a458242e-ac12-41be-8bc6-b9d512a84c39", "value": 491012, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646833468, "uuid": "25bc388d-7865-48f7-ac79-bed781baebfb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646833468, "uuid": "9264d29d-565a-4076-9eff-e53bcb9b213d", "value": "emotet_exe_e5_cbcfd8ca0657b02faa461478d02666dad7e9dfd6609c354cfa58dcf394e56a0d_2022-03-09__134423.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8977b539-9f9d-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646825950, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646825950, "uuid": "5e5fb064-a102-4458-821a-fbef70dc5d42", "comment": "Malware payload (Heodo)", "value": "4828a1ec98ee09917cb033a7855b58f8", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646825950, "uuid": "7d4fd3ee-9d2f-4936-a93f-b6e54ea90de1", "comment": "Malware payload (Heodo)", "value": "cbf0825b80c45ded4733b770432aa51fc67eb1b628d6db7a035876f39f989302", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646825950, "uuid": "610ac760-6573-4315-b65c-4d296350d165", "comment": "Malware payload (Heodo)", "value": "ac42173949fbfb3693d9a13261596a2bde5aea04", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646825950, "uuid": "b91139fc-d70c-48dc-99a0-51263c7426f0", "comment": "Malware payload (Heodo)", "value": "00ee347fb9de793fc00509a2bda0be7a2fa936f76ac182f14a2035ebf6e7ebe6050ed5be2e9e6e5f64a51855ab42073f", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646825950, "uuid": "d13810cc-d05f-442b-aec6-ef6d81ed4cf5", "value": "T10E03E06DD095199ED222253FCB1C0FB4134D0A0EA651E6CD2D54E6EC275A1FB07AF8B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646825950, "uuid": "3ab11b2a-d654-4ef0-bf96-b9a8582e95d7", "value": "768:Ctby3nCsqi1O3mnOzyKfcrND59V+L9Rw4eWrXcTqy0y3:6bunC5iymqylND59V4jwmXc2Xy3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646825950, "uuid": "0082ba18-c8b7-4064-8d07-6c5c351a2880", "value": 41004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646825950, "uuid": "5cf8ae7b-eed7-482c-9b7d-5fd4be270710", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646825950, "uuid": "9960d3d3-1d4b-4f8a-ab82-0ed9f5db2409", "value": "payment.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5709e0c2-9fd8-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646851206, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646851206, "uuid": "3cbf0814-e837-4842-98e0-1fbcdcbb0ed5", "comment": "Malware payload (Heodo)", "value": "c40fa2e15abc849c9dd59cd340401596", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646851206, "uuid": "579932a8-5e49-46d0-95ab-462fcc39f238", "comment": "Malware payload (Heodo)", "value": "cc4186ac24c47e56fb13eb2d3c26861c22856e3a9c288e4bf9d7524c586b82a5", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646851206, "uuid": "051d0d7a-40f6-4868-b82f-6d6d7d40f0ba", "comment": "Malware payload (Heodo)", "value": "308ff779aedae50aa7d826c9aef9fcb90007e798", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646851206, "uuid": "1c7ff32c-4a38-4f9a-b3e1-a378fc11abed", "comment": "Malware payload (Heodo)", "value": "157242b22c42f829543dfb5b4dff662874ef07a6a834994b905ff43843065a3665ec396b7daa05ed42d32c81a8921611", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646851206, "uuid": "489ea3b5-c922-43e7-b24f-1eb316616328", "value": "T144257C107E8A817EC71B85B30836676D6FFEAB204B6CA1CB478175ED2D316C29B36705", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646851206, "uuid": "22b1b3aa-dd71-4094-b8e3-06480632c2f5", "value": "087c9809507dfca4c3283e6c7539e91c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646851206, "uuid": "439a714c-6944-479e-bbb6-ea73263d6ebc", "value": "12288:cR5SOyRHiA6m0OcElhzt6JtcS1j2xKkr:cR5SOrKlhzEtcK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646851206, "uuid": "1b69e0c1-8e71-4b6c-83f2-62f21868206d", "value": 1040384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646851206, "uuid": "55747105-8179-4e3d-b149-4bc77dc82159", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646851206, "uuid": "997534bd-e790-44ad-a37c-7560f09ce6ff", "value": "o47ExhSpP7K.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34ae24ba-9fb9-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646837834, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646837834, "uuid": "e55c13dd-90e7-43b0-87b0-167bef48f56a", "comment": "Malware payload", "value": "9c8cb5fa4cf40ad86eec724f075e390a", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646837834, "uuid": "4e0d4191-8643-422f-b185-00586922a87c", "comment": "Malware payload", "value": "cca7ccbe329ca287ec83e43439486cdd0139b91ef050f193ac084d39221778a1", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646837834, "uuid": "80249af5-e098-4b3e-9def-99af08af7274", "comment": "Malware payload", "value": "226826a2ba518a16d9034df237441098806dda8f", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646837834, "uuid": "750d85af-91cd-421e-9aea-bcaa300e4927", "comment": "Malware payload", "value": "bc005edeb01881203d09010b4515106a32e470a4929119b854abde8c3dbdec15b72aaf76af67b275d70b43b8daa81935", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646837834, "uuid": "59a0b6f2-2602-4492-8d04-17f71566b0b5", "value": "T16384CF3C75DCEF60D18C173BC8F9BC2A7B75B2960A51E39B4A81223C3E51769A04526F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646837834, "uuid": "554d9fb6-ae1e-4f6c-8b78-c535b5ce6e27", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646837834, "uuid": "017dbd9b-17c4-4155-8544-340f30fe2fad", "value": "12288:B0ht0OY1K+THgBnJXWr7bImnuwt2Fcpcplcrzj8:X1K0ABcjIm1tYcp4+z8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646837834, "uuid": "040b3419-99f2-4802-bef5-fb3df2a21a76", "value": 395776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646837834, "uuid": "9c921df1-3693-495a-8b50-474f253f2c7d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646837834, "uuid": "8da27efa-9da4-4495-8e17-51c8eff112bb", "value": "Vwqxf1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a585e9ab-9fc2-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1646841889, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646841889, "uuid": "e018fa82-e6e3-4ad3-97da-8230995ee06d", "comment": "Malware payload (Loki)", "value": "0af62e829345738bc21f35da5c111282", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "rev", "colour": "#6B37D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646841889, "uuid": "7cf906c7-684a-4f9e-a10f-7e8487cc90d3", "comment": "Malware payload (Loki)", "value": "cd586f1d88beb63a9e8cbf13ce089f544c52c0937d2d1e9b6a784a21b6ff5ef1", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "rev", "colour": "#6B37D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646841889, "uuid": "6a344c27-0589-4bea-93db-0116804ecd4d", "comment": "Malware payload (Loki)", "value": "15867f8d4e4529ea0a98566b90b018b6857c3cf8", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "rev", "colour": "#6B37D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646841889, "uuid": "59bc2f07-fa23-40a8-a799-30481e8d07bb", "comment": "Malware payload (Loki)", "value": "229df0cfad7274a5705b18f4f238a4bfb5c3e1cf3fb6482716e794e26238d1db7e28db9c97df39a201d6cfbe89dbaff7", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "rev", "colour": "#6B37D5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646841889, "uuid": "239ea918-bf85-4463-a5f3-46a3cf2f5df7", "value": "T17B42BF52C9CF5658EAB214F04708FA671B029930BD5C38CC469A7A0F7B95586F4F48DE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646841889, "uuid": "8e9e39db-860d-486a-95a1-a9015d7f72b2", "value": "192:7CuHLfJe38rxQGn1Qwjf9/YB+9rAH43TQeVvbeilfu8lUCFeQJe1CBi2c1/kCqgU:7RLfJeMrxf1QsBM+9r643rVvbeilGUUE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646841889, "uuid": "23d94ec6-ba46-43e4-9e28-6f4fe4740e5d", "value": 12185, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646841889, "uuid": "0a4a54e9-df9a-4eac-a1a0-486878f947be", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646841889, "uuid": "cb632c30-d9c7-4969-be14-3cdc24ed895f", "value": "5013020067703.rev", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6d5e8ea-9fc1-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646841461, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646841461, "uuid": "208ce077-3dec-4ee8-a5a2-a22da8e6f263", "comment": "Malware payload (Heodo)", "value": "e9329670644e51ea439ffbc48159d490", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646841461, "uuid": "5793f977-a8a7-4218-9ee3-74c29af75982", "comment": "Malware payload (Heodo)", "value": "cd5be15286700b49fc029264666b55bb6bbf1517e651d65f7f682c6731738b02", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646841461, "uuid": "06970d7e-4c8c-4dbb-9a26-433c9237cc05", "comment": "Malware payload (Heodo)", "value": "2bfc10fd7a2bf9b6cea56a35bc41d8e8fa1042d1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646841461, "uuid": "a6398359-ba20-472c-9436-00334c08cf4f", "comment": "Malware payload (Heodo)", "value": "72b33eb0ece4d0f69da537f4d0cc65e157d876b300afac14b7841ba200f789392948ac7f1157c9c362c874725d728d0c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646841461, "uuid": "454f04a4-9bbf-422a-8a2e-e2b2d83a2f6b", "value": "T17D257C107E8A817EC71B85B30836676D6FFEAB204B6CA1CB478175ED2D316C29B36705", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646841461, "uuid": "6c11676c-ee15-427d-bb5c-42cb65e9fbc9", "value": "087c9809507dfca4c3283e6c7539e91c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646841461, "uuid": "fb2c54e7-e59f-4f3b-9d38-f376f8e73958", "value": "12288:cR5SOyRHiA6m0OcElmzt6JtcS1j2xKkr:cR5SOrKlmzEtcK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646841461, "uuid": "e007d401-40ec-4e0c-88f9-514dff8c0f55", "value": 1040384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646841461, "uuid": "54b1a7a6-df01-43d4-866c-5e5cf1a75145", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646841461, "uuid": "49a70e2b-17fb-4920-ad25-3202fa06fd52", "value": "e9329670644e51ea439ffbc48159d490", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01483d27-9f91-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1646820568, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646820568, "uuid": "30f50f86-ee6d-4042-a7b7-da5aca17a9d9", "comment": "Malware payload (AgentTesla)", "value": "41bd89456f6730e9ca965821907dff48", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646820568, "uuid": "2b9c0bbf-1292-4c13-a9bd-e41626841b31", "comment": "Malware payload (AgentTesla)", "value": "cd73667d677fa1dd81f16bf314fdc9388355d3c076c13b3068727bd4ea620312", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646820568, "uuid": "5389faf4-e8bd-4809-960f-ffd1cc4c7c3c", "comment": "Malware payload (AgentTesla)", "value": "2bfa41c4d88ec6457449b7fca06e6323dfa67019", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646820568, "uuid": "7adf7638-6d42-474d-8d4d-1fc1acd69634", "comment": "Malware payload (AgentTesla)", "value": "b3bfee2cea9125d6f0ad1fd5c96b07c96ba42d71f249d665afdfccc10ad5c8a22b897afc9f73041b2a0e15d3f1184081", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646820568, "uuid": "621b86b5-c320-4a4d-a94b-4083ad62cddf", "value": "T1EAF42307D06FB00E1EF27D2662D4427DF11E208AE7E9CFC6F1ED626D206768968165CD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646820568, "uuid": "4c62636f-6a69-4e37-a875-74a5510cccfe", "value": "24576:vMvAR986BkkEzHBU0gi+40vhDYvC7Ba+BJ/P:vMojdz2+Ni+h+0vB5P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646820568, "uuid": "8b49b4cd-b897-41c5-9a8f-4c10e5d040d4", "value": 788869, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646820568, "uuid": "4adfe611-2029-41be-ac8c-ed5994984dae", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646820568, "uuid": "ced6d280-bcdb-42bb-bbd0-2f38b1a63d39", "value": "BL-INVOICE SHIPPING DOCUMENTS.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1b491f8-9fcc-11ec-9275-42010a9c0029", "comment": "Malware payload (Quakbot)", "timestamp": 1646846311, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646846311, "uuid": "94fcddaa-5947-4a03-aa1c-cb47bb5286b0", "comment": "Malware payload (Quakbot)", "value": "c6a096b8bd1d51ba8eb72d219f5cd6f5", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama164", "colour": "#6C68A0", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646846311, "uuid": "0080e38a-e9bb-4569-9ea7-f4798e870a7a", "comment": "Malware payload (Quakbot)", "value": "cdd76708c7f99f29ba010696a7415a277a076c6f791b603a8b4001230d371930", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama164", "colour": "#6C68A0", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646846311, "uuid": "7e2c1636-2d4a-4479-ab5c-95061bf167dd", "comment": "Malware payload (Quakbot)", "value": "e4da9086feebceac8625c5f49f9fdbe493e416db", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama164", "colour": "#6C68A0", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646846311, "uuid": "79b5f9c2-6b5d-4679-b27a-392563b7ce98", "comment": "Malware payload (Quakbot)", "value": "60ca2eaf67ee2cc95b8efbddc18b6b072c7b6716fd55c1035094934f93fd76de191501efc847e47009feb4f23182e930", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama164", "colour": "#6C68A0", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646846311, "uuid": "c58e429e-6c61-42ac-a621-bc1eaf118556", "value": "T153657D23F2C1887AD4761A3C9D1B739998BA79112D28F4C77AD44E8C1F37A433666393", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646846311, "uuid": "089e7a05-c476-413b-aca9-453aeff1e269", "value": "cf78a88c4b0403a976a85038ec51a351", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646846311, "uuid": "ed734b71-d3e6-4f61-8474-b8a1c8b9cba0", "value": "24576:LP2GXxd5hyXOZk/R8SoMbEYN54UUrW/tRJfJXOIU2SAHl4XoWSIgX4T:Lu8jI6kcYN9RXiKKgX4T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646846311, "uuid": "08abe753-af83-40bc-8aa6-341f7ef15e86", "value": 1502720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646846311, "uuid": "4b76ce6f-beea-4538-aac9-90202f87f51d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646846311, "uuid": "914f80bb-e9c1-4896-b862-6d5aa53d50dc", "value": "7103108.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71648ee6-9fc1-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1646841372, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646841372, "uuid": "8720d9c0-848e-4b78-85ea-c44bba23d47b", "comment": "Malware payload (Formbook)", "value": "27f9dbee6f27061916fe571947e5bae2", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646841372, "uuid": "d840733a-67bb-4d03-acff-d07de1db9060", "comment": "Malware payload (Formbook)", "value": "cdf39c12b7607f2ea7f295d948b2e42020d9ed444c30f921bc88e7aa9922c800", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646841372, "uuid": "ced84197-15c1-4796-b3db-331d86d90768", "comment": "Malware payload (Formbook)", "value": "b6dd15ca53bc8f165e482e6c323178165becd093", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646841372, "uuid": "7755247a-834b-487b-a767-57c66f100c8d", "comment": "Malware payload (Formbook)", "value": "63b51fca87420da7a1d1d1d0ace4bc56546c472843b323c83c4e56c95dbdba76c2aacb7c6a51e29993477379ef62625b", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646841372, "uuid": "da603de6-010f-489a-bcff-2a54175d0ba5", "value": "T1F1B4231AB20F765FFFD1A1DF468CBE50A9A8BC39AE633C0E236145BEC544B5814D35A0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646841372, "uuid": "97ea5ba1-7099-4cba-8e78-9a077cfd3a31", "value": "12288://As7FkWoh4vrW2xJ0sO0Ex/s2jPse6OHXU:l6wrW2xJ0f0K02jse6Ok", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646841372, "uuid": "f72022e1-5aa4-4fd9-a7ff-eb98a43286a7", "value": 499919, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646841372, "uuid": "8da9efec-6107-41e4-9bd7-d7d8733a91e9", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646841372, "uuid": "970896b6-7fd2-4cb3-a68c-548a1990d94d", "value": "SOA.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9dbd3aa6-9fbb-11ec-9275-42010a9c0029", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1646838869, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646838869, "uuid": "4742f46e-2b20-4ccd-a7c7-d6de3954b5b7", "comment": "Malware payload (AveMariaRAT)", "value": "dfb3149f0295b3a390bd9d56d9366540", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646838869, "uuid": "57702c7c-c925-4e62-8c68-5b44d80fbe79", "comment": "Malware payload (AveMariaRAT)", "value": "ce039e3a35af6b4094bc22e30182c97b713f9ec6314c56a8a77864a373f76313", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646838869, "uuid": "78ab2c2a-0de2-4645-b104-f3b1e1227062", "comment": "Malware payload (AveMariaRAT)", "value": "926bcdbd6fd53f1e5579ef560d63dc9c92529ae9", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646838869, "uuid": "10f3c16a-1ad5-46ba-876e-b241afc06a38", "comment": "Malware payload (AveMariaRAT)", "value": "dc728ae37f0ac290bdadb67c5475337873e78c82eb3baebdd7e1cdeb967b17631b8d8c044793c8717198cb5ff875b711", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646838869, "uuid": "fb76ae0d-983e-4268-ba17-4beefafef9c7", "value": "T11F05DF587680B5DFC457CD738D981C20AA70A477470BE707A88726AD9A4E2DFCF260F6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646838869, "uuid": "755eb4cf-24d0-403a-b6db-43c78d7c4b2f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646838869, "uuid": "92413678-4e0b-456a-9c89-bacfdb716226", "value": "12288:OpqgcoO53lAk+WAir+SXgDY1k+KOZ4Hgg4yoxAK/YRYsvB71hv9C2E9K452pwaTN:aqgcoO5H/qSXgDor4HLUAf/h4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646838869, "uuid": "85c148c4-8516-4065-8c84-4609a4f0fb16", "value": 803328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646838869, "uuid": "05accc72-47c0-4519-aa1e-2d6fcdd34f76", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646838869, "uuid": "af573f07-2296-4c32-947d-2fe9e9e2b2a1", "value": "Arajanlat keres 08\u00b703\u00b72022\u00b7pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b988264c-9fc5-11ec-9275-42010a9c0029", "comment": "Malware payload (njrat)", "timestamp": 1646843211, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646843211, "uuid": "2bd9de83-fc83-4680-a229-e00542192b75", "comment": "Malware payload (njrat)", "value": "49da7e4e62e1e9dd011b9476b37318f0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646843211, "uuid": "393e6279-5840-4135-be9b-b96591371f8e", "comment": "Malware payload (njrat)", "value": "cf420c735e1953efabe932617ff48eaf389429ad511cc7f8ebda7356a74ae1e6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646843211, "uuid": "7fd5d28b-e17e-4c10-8d63-d0b88be4408a", "comment": "Malware payload (njrat)", "value": "4452f1f9023477c56d6bfd2e1552bdc3001fd6eb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646843211, "uuid": "da5701ff-f5b0-45de-8a48-5b1e745d7521", "comment": "Malware payload (njrat)", "value": "4d365338a051d34042288ab160d665b6456fcb48ccbc9f9400466d0289547ae07f5f261fc7b90931fde6472b86c3e0b7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646843211, "uuid": "9ea43190-3a98-41cd-9153-bb14af2e2fdd", "value": "T1BD13D88CBA84E175D5FF8BF1B492B2890B719017A902D30F99F154D98FB3AC09611EE7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646843211, "uuid": "c5d9fa97-910e-499e-b358-38afca46d705", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646843211, "uuid": "5d06a8e8-9564-4a49-8e2e-b81dfab8d1bf", "value": "384:2ZyuNX7xdW/IUyNZa55EFiTYMWM7bV56l9C9D9O5UE5QzwBlpJNakkjh/TzF7pW9:sdrxIghNZk5EFiTVxbC3vQO+ud+L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646843211, "uuid": "4e0b3260-faec-438e-ab29-a0581725b273", "value": 44032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646843211, "uuid": "6e6d5d27-2dcc-497d-9f44-12c71f09e92d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646843211, "uuid": "f1538237-631b-4aae-ae9a-02afa93983f9", "value": "49da7e4e62e1e9dd011b9476b37318f0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "683ba016-9fb6-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646836632, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646836632, "uuid": "4f7c473a-2c31-4a0c-9ed2-79494febb316", "comment": "Malware payload", "value": "58121302ab1bfe023ac58cb270b83f19", "object_relation": "md5", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646836632, "uuid": "c1296ad7-f1d9-416c-8ffa-e803e23d79ef", "comment": "Malware payload", "value": "d03ac314b35a4a7ac15c5a8dfcc519b92214a70242d8ff9404970c905c3dd480", "object_relation": "sha256", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646836632, "uuid": "d8711030-234a-4775-bee7-73fb9b2c637c", "comment": "Malware payload", "value": "47c899c11bf607f981fb96e792436b01f00971c5", "object_relation": "sha1", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646836632, "uuid": "a12f2239-1bb5-44f3-8102-a94a78eac16e", "comment": "Malware payload", "value": "791621dfb265c3888ab709bed78208826276eb21b7ecb23931aa2f65ed9ebef77efa9500a989047ab480f2fb23298023", "object_relation": "sha3-384", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646836632, "uuid": "e1fce941-7f30-4910-8e81-4ae33138449d", "value": "T1A454F1267741C446CA1953358DE2C6EB6A37FC41AF7A46073190F33F6F372E08A9265A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646836632, "uuid": "ba40437f-58ed-49e6-91cb-41ccc5052fc3", "value": "6144:2xEtjPOtioVjDGUU1qfDlavx+W2QnAAaZcVMsp85SnElszaVNCIzWmSB+TZaSZF/:sZGp85LSeLCaTsSZlgLT324zjkWpTy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646836632, "uuid": "deed66f8-7ce2-4fbb-bea9-16c8da1aa377", "value": 298496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646836632, "uuid": "8b2b3e17-aadf-41c7-9064-1e88b5c3012c", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646836632, "uuid": "feb6e197-856a-438a-9604-4a6c0acde25b", "value": "Detalles de Envio.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30e59c43-9fe9-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646858443, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646858443, "uuid": "391eb344-395c-4bdb-a069-3d0f823d6406", "comment": "Malware payload", "value": "cc9cc11e3c84685f61f029aa5e67771d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646858443, "uuid": "c039b2e2-b801-45e4-848d-7ae1a9cf8ed9", "comment": "Malware payload", "value": "d048d1f750a42a6ec45af4ea95fa97161f5d69e178b5c8cd467ddb1bb2fd69a1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646858443, "uuid": "6d0cf86d-1730-4d2a-9cb7-6182d5010fa0", "comment": "Malware payload", "value": "c8c83972ea0d33f0bb1ba3d9876b5dc64deee6c3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646858443, "uuid": "edf8db54-d757-4719-b24e-c65e6c9e2cee", "comment": "Malware payload", "value": "ed306bf8f2a66e5e817634d8fd0b892b4809ebbee5a9017b77a7b11477845bedcf25baeebf3acf586dbb48ce0c7953e9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646858443, "uuid": "e4d89559-05aa-4ff3-b1da-8d750006f5a6", "value": "T157353322BB8729D9C334DA311CA49140B9D791D7C2FA8734BB4DB269CE5C242EFC54E6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646858443, "uuid": "81499735-be68-4936-aa9e-89b6f5a82610", "value": "a6dd62d0926765a235772eb148b8ae30", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646858443, "uuid": "07b0cdfd-19d8-4103-a557-c74876c302b1", "value": "24576:iWQhlcR+QoQa65HEwr6/YoDSvCls2jDEc8VjxXRxMRKyk:iWQ3QoQa61Ewr6bf9DD8RVMM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646858443, "uuid": "40f6c965-371c-41e7-86dc-9e29a6abdd21", "value": 1130048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646858443, "uuid": "f49b8b5d-c72b-4c9d-88bd-b88f655a8038", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646858443, "uuid": "ffe87504-7fcc-482f-a263-5be52c0588d5", "value": "cc9cc11e3c84685f61f029aa5e67771d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68bc1abb-9fe5-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646856819, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646856819, "uuid": "0a0d0b19-d4ac-461d-b506-06a2a75abc95", "comment": "Malware payload (Heodo)", "value": "2ac3d9caf54263a45433fb1d6de36616", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646856819, "uuid": "66b7fb9c-aaec-4175-abbd-1d1d9f0791fe", "comment": "Malware payload (Heodo)", "value": "d0674c1fdead7120fc7acdf2094492e97923bfd53cc47e7e1a1b0fa71edc2e5f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646856819, "uuid": "51821745-e383-44bc-9be5-47c670a29fc9", "comment": "Malware payload (Heodo)", "value": "ee4c9dc79e8786c4fd5ea4209224875833adc35f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646856819, "uuid": "3089cb1e-4a41-4665-a179-340796b89c07", "comment": "Malware payload (Heodo)", "value": "0f40ca02480c18460b8e49873862f1bd6086a125819e11ff57caf4db489f4f1c39f6147f807c7aafebb953d5cdfadb88", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646856819, "uuid": "66e967a1-2a89-43a7-9d59-6f19d9abc988", "value": "T1D4257C107E8A817EC71B85B30836676D6FFEAB204B6CA1CB478175ED2D316C29B36705", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646856819, "uuid": "2f11129c-e7ed-4421-a78d-0bffcc6cd740", "value": "087c9809507dfca4c3283e6c7539e91c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646856819, "uuid": "9ac39c0c-d6a1-40e7-9b5d-bc5dd594fc40", "value": "12288:cR5SOyRHiA6m0OcElpzt6JtcS1j2xKkr:cR5SOrKlpzEtcK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646856819, "uuid": "c051f234-0a06-4c84-a2c8-09f78f2f2c3e", "value": 1040384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646856819, "uuid": "a833ef1e-f08a-44be-8f15-7d80aadabcdc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646856819, "uuid": "747a6c1d-e6de-43fd-a711-424aabfdd7c0", "value": "2ac3d9caf54263a45433fb1d6de36616", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5dd98812-9fec-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646859807, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646859807, "uuid": "e321a8c7-ac6e-414b-be88-edda1e245879", "comment": "Malware payload (Heodo)", "value": "9f9f1fda676929a20a443b1b99963ab3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646859807, "uuid": "970cbd76-96c7-46f8-b5f8-05680db97ddd", "comment": "Malware payload (Heodo)", "value": "d0718c840a66def443a70f771536a1a18c3e3a1322cb1512b648d01fdcacbf31", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646859807, "uuid": "3c4ab590-f7e0-460b-95d4-f5aa59120fe9", "comment": "Malware payload (Heodo)", "value": "51ff6cc64c42e2dedea9d6613030900bb586e882", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646859807, "uuid": "f6bde883-6c77-4dd6-9ad9-f02418a9e31c", "comment": "Malware payload (Heodo)", "value": "e32241cc81387e2c5dcd067a40bf48eab32ba5fd1ea069154aced9fb8c650fe0fbe628f1c58b02d8cd6361355e632776", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646859807, "uuid": "4bd4ae7a-ad56-4af1-8416-fb9d5c84d311", "value": "T198257C107E8A817EC71B85B30836676D6FFEAB204B6CA1CB478175ED2D316C29B36705", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646859807, "uuid": "8d32d472-6f9a-4af8-bc5a-2941b40d9824", "value": "087c9809507dfca4c3283e6c7539e91c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646859807, "uuid": "9246a3cb-b679-4281-a5e1-63e7a23796b8", "value": "12288:cR5SOyRHiA6m0OcElozt6JtcS1j2xKkr:cR5SOrKlozEtcK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646859807, "uuid": "6fea93b4-2b56-46f2-aba9-93563016ac9c", "value": 1040384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646859807, "uuid": "bcb79372-f40c-4e53-91ee-1949a1a5682d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646859807, "uuid": "b29a056f-9a13-4365-9561-f50bce7372f0", "value": "9f9f1fda676929a20a443b1b99963ab3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c52ba17-9fb5-11ec-9275-42010a9c0029", "comment": "Malware payload (Stop)", "timestamp": 1646836209, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646836209, "uuid": "f5d32175-d323-4bf5-9253-6c361c0fe1f9", "comment": "Malware payload (Stop)", "value": "26a84c76964ae10629fecd9b377504b1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646836209, "uuid": "c848af2f-8bb3-4897-af6c-ab366e397e64", "comment": "Malware payload (Stop)", "value": "d076cadb82d3c3e14c11a3a0bbf0f42dfade089175a7afcaa62b9f18b2ca0732", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646836209, "uuid": "315585bd-ffd3-4313-ac1c-d0e740f00f9a", "comment": "Malware payload (Stop)", "value": "cd0806dcdbe98fdd4a8f7c1162fdfa26c7704fac", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646836209, "uuid": "7392d9d8-8fea-47d2-873f-659faff05beb", "comment": "Malware payload (Stop)", "value": "e82aac6f1ce4969669c2e2ebb73eda334534b9f0ce46d83241f32bf4ba92236b9aa7063f2870c25967d2478ed9babd12", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646836209, "uuid": "ee29a76a-ea5c-4bb0-9bdc-d3ab6aaf6af9", "value": "T1E60512217A40D032C2B62635571ACED109BFF93A6FA59A0773DC1A2DBD323805E7625F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646836209, "uuid": "56d48ac3-f12b-4346-ae85-55fba9f37fc7", "value": "beef0e239bafb748de7fe31ae987ee1f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646836209, "uuid": "60bac300-aaea-49ef-ae45-10b7bbd1adbe", "value": "12288:EbSjPDOZhDneyKVr8/npkmUW7PeaR4C+uI9inTo48vN8u5pNrDk:Q3BBvf7RNI9gToQEXrDk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646836209, "uuid": "ab2ded77-0054-4a97-9c60-c2b1801914a3", "value": 836096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646836209, "uuid": "e8067891-0dfb-45a9-bf71-ce774bdb0d76", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646836209, "uuid": "20e7130e-5531-4b76-8e15-bd7bacf7502d", "value": "26a84c76964ae10629fecd9b377504b1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c04fffe-9f3c-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646784240, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646784240, "uuid": "e8c6b71f-d3fc-4d2e-a61f-166980f5f370", "comment": "Malware payload (Heodo)", "value": "adbdf84efe1a4de8b4fbb841565894a6", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646784240, "uuid": "6c434923-b3b3-4644-9199-af84bcd82ec0", "comment": "Malware payload (Heodo)", "value": "d130e0b4fc046b286d9996051e449e5cd3e4867987bba450c800937b624f4134", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646784240, "uuid": "2d3285a1-a307-4f61-971f-d409d2466e34", "comment": "Malware payload (Heodo)", "value": "d4f74fff2730fa6b68185f989759b6080f3bbcda", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646784240, "uuid": "74f3f414-25af-4060-aeb0-60a24f3779d7", "comment": "Malware payload (Heodo)", "value": "14153040253fe34d8543a3d0107e3215e4bfd046b307051c0e21248d7baaded758ce00205ccae0c6f00c2e0ce56f2ce2", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646784240, "uuid": "e4766bee-08be-4366-9d6a-cb7ab50366ef", "value": "T174B44C22E151E0B4C21744360607737DE60FADF01B95B277A3B015AFBAB5E71EE26326", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646784240, "uuid": "1930bd8e-9b63-449b-933d-12eaabbcabc5", "value": "c354d2e1bcc359dcb00a22865c038d4a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646784240, "uuid": "5c5bf422-2920-452a-a867-91647fa4a133", "value": "6144:TMhEi6lq1EvTzbQJqnoibRcJQfTf2ZsIhzED5TJycXo3ZqdK/J:hFGibRYQr6koko3od", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646784240, "uuid": "dcd65cf6-6816-4edb-bf7d-d2cfa550be29", "value": 507904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646784240, "uuid": "dd47d558-228f-4bf2-90ac-4bcc9f83e8be", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646784240, "uuid": "8600bf41-a079-41c3-9595-d16f99425c79", "value": "emotet_exe_e5_d130e0b4fc046b286d9996051e449e5cd3e4867987bba450c800937b624f4134_2022-03-09__000354.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68d5581c-9fdc-11ec-9275-42010a9c0029", "comment": "Malware payload (Quakbot)", "timestamp": 1646852954, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646852954, "uuid": "f04a3f7d-58ca-49c3-9dc9-9c7e8a2abecd", "comment": "Malware payload (Quakbot)", "value": "b79eba312bc9d98c2c4abb42cc1c2c90", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama164", "colour": "#6C68A0", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646852954, "uuid": "1266f52b-c913-49fc-abff-d0f12c9c4167", "comment": "Malware payload (Quakbot)", "value": "d21f4ff73f5ea8666e1ecdef7c76287e050c6735223515fcfa2bc7ebc0a2898e", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama164", "colour": "#6C68A0", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646852954, "uuid": "4ee0b0fc-230e-467d-8666-6679dec353c4", "comment": "Malware payload (Quakbot)", "value": "e913fbbfd06495a06cb8364c45a4596025bb2a2c", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama164", "colour": "#6C68A0", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646852954, "uuid": "0d346c74-6bd9-4ab9-ac7c-a6a9c35955c3", "comment": "Malware payload (Quakbot)", "value": "66226b925c7b8b20532ddea05e93ac110a07d4ff91e2a4faf5e861cd18a90455377729cf51dce415c2465e8864b33c48", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama164", "colour": "#6C68A0", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646852954, "uuid": "b6dbed4c-bf39-44ae-8fc3-2532ab27f413", "value": "T197657D23F2C1887AD4761A3C9D1B739998BA79112D28F4C77AD44E8C1F37A433666393", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646852954, "uuid": "928c3ab1-494d-46a6-94bc-629e6016aec3", "value": "cf78a88c4b0403a976a85038ec51a351", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646852954, "uuid": "f7cf2716-3aef-4c78-b1ac-17f5df2081f3", "value": "24576:LP2GXxd5hyXOZk/R8SoMbEYN54UUrW/tRJfJqOIU2SAHl4XoWSIgX4T:Lu8jI6kcYN9RqiKKgX4T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646852954, "uuid": "aacbce4b-80df-4eed-a406-048c9ec53012", "value": 1502720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646852954, "uuid": "946ea02a-77a6-4183-b08b-ca2a28b52490", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646852954, "uuid": "cde03d2d-6b52-4bee-855e-d3a5064e052b", "value": "6565231.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b50feb13-9ffa-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646865967, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646865967, "uuid": "3a8c2e08-3161-4072-aff9-e74b41e875be", "comment": "Malware payload", "value": "0b9fc54f9e3a1a299881582f15821a96", "object_relation": "md5", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646865967, "uuid": "acc31b53-7bc6-4447-882c-15a8c0d69120", "comment": "Malware payload", "value": "d236addefa5479b4cfc5ce343a6fe462924c79eebcdda29b1327f7f5c994d3d0", "object_relation": "sha256", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646865967, "uuid": "23b66197-9f8d-4d21-9431-5df37abc70e2", "comment": "Malware payload", "value": "1b49af4904e0a508760f33ffae9f469dd43598af", "object_relation": "sha1", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646865967, "uuid": "3b79b84f-c3b9-4df1-9c44-64a49456bacd", "comment": "Malware payload", "value": "24c902ae146030d3087d3bc0bcda8d8ed0d2e9043cbc326bc6ecac6462eb0ae1773b0533c30ef8f9fb59958ab2275e72", "object_relation": "sha3-384", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646865967, "uuid": "47a4ee84-49a6-4734-bf06-baafdf97e213", "value": "T12A13D02CE6573105D6319CBD560CDCF56E0D30A7550ADA8B1448BACC2FC2BFB12AF198", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646865967, "uuid": "09b2cf53-7de9-45d8-a30e-55ee8be8f2bb", "value": "768:iFVCToSyUn+qpOw+pyZfQCwBzii1H/KNsH7meB1Id5qXkm1qVw0cyjA:iFVQsUnpOw+pyZfQCezfCNRejIdcXheg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646865967, "uuid": "a32a711a-1ef4-4fb0-970f-1ea1768345fe", "value": 44642, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646865967, "uuid": "5bedced1-82a3-4fee-9fce-89d1e3376969", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646865967, "uuid": "395de515-78f7-4ee7-bc87-7e8c86dc13ab", "value": "ohne Titel_0903.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18a51806-9f99-11ec-9275-42010a9c0029", "comment": "Malware payload (QuasarRAT)", "timestamp": 1646824043, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646824043, "uuid": "d5ef15af-7fd9-416d-8725-2f5842ea1e5d", "comment": "Malware payload (QuasarRAT)", "value": "ce29b1613037ee23656c6d2f78db41c5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646824043, "uuid": "f7933af6-305b-466c-af24-8447f0390279", "comment": "Malware payload (QuasarRAT)", "value": "d26ba4768bef5a8e4424b6c90b74b0c22129f9df94022b5f84850c22b289b7e7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646824043, "uuid": "15648f61-16ae-458f-8541-e42ef7605829", "comment": "Malware payload (QuasarRAT)", "value": "d7635ea6c4b971d49738ec07eb8890884627b44f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646824043, "uuid": "dc32d9f2-38e8-4bd5-ace7-d02fdb6777e8", "comment": "Malware payload (QuasarRAT)", "value": "7bd85ea0590623bda25bf99c93adf573a56b5cb1420c5efa186cc4b0303126d27abdd3cb3cf0bd2d111d3f57d4bab57f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646824043, "uuid": "9eccc981-705a-4186-ad5f-e2d1626aaba7", "value": "T196B46C4023F8862BE57E5779E83115205BF9F80BB26BFB5F4541B0E92C667069E40BB3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646824043, "uuid": "01048d5f-0643-4be9-bd46-a31c274b4166", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646824043, "uuid": "73a4b184-e521-4c5e-9690-877291175487", "value": "6144:UTEgdc0Y8XAGbgiIN2RSB4tzRxqpIgRs2bCscEuOb8F9NyAdFiHiTcTR3C:UTEgdfYGbg8hPs+p3yioCTcdC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646824043, "uuid": "35b0b41c-68df-4a2c-8d4e-30cc7b1f2eaa", "value": 514048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646824043, "uuid": "a5b2346b-2abf-4e6f-be71-c677fcfd3d9e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646824043, "uuid": "a5ad76d3-cdd1-44c3-909c-4c8417996174", "value": "cnmain.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f73c225b-9fc8-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1646844603, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646844603, "uuid": "06c9e100-3e2f-4cc5-ab2d-c055f7066d3c", "comment": "Malware payload (Mirai)", "value": "40c8f1208ed275bfd82b4ef118207989", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646844603, "uuid": "bde8a3ca-40e5-483a-ab67-f75bb7234e38", "comment": "Malware payload (Mirai)", "value": "d2a6ab24a218d247b90708105acf3d890493b44793d3ab17825f1428b1994aad", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646844603, "uuid": "5969ef12-d60f-4025-81a0-2822c5ee2b79", "comment": "Malware payload (Mirai)", "value": "c69c9eb222fd095f0fe39de0cdfffee1b8d29495", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646844603, "uuid": "44e6b6eb-7ed6-4f65-9e75-8ad6c7517f5f", "comment": "Malware payload (Mirai)", "value": "73953b3f9f0459f185d8f771351df5250df84abfbcc70244d0281f1a733df2e472efd4ff7f600ab63f0e3e6a9e7f5a63", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646844603, "uuid": "4e97714b-8cac-47f5-8e2b-111d4e87c895", "value": "T124536DC9E5C3E5F5EC110A71313BEF3286B7E67D2069DFA7D3986432AA11A02D11639C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646844603, "uuid": "e6b418a9-ccf0-44b2-b32a-daf1606dcbbe", "value": "1536:Z7qARubgzY/bEJyvRcpE80LDHhklv4JQC9DSW:NP+eY/bEJlYXBk9AP9l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646844603, "uuid": "65fb394c-846f-45b7-a3db-f7e4bcddb874", "value": 62864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646844603, "uuid": "5ca35d1f-9373-4d63-939f-6a3e3b56feba", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646844603, "uuid": "fd8d7c15-3f92-4663-b084-754180997e74", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2fe90814-9fbf-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1646840403, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646840403, "uuid": "d2e9177a-9137-4dc9-873f-cb76c4c8460a", "comment": "Malware payload (Mirai)", "value": "ad572f145fb973425e8e6210ab4fb2f1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646840403, "uuid": "699d8fbc-2b67-4f1d-bd4b-33fa0c160d6c", "comment": "Malware payload (Mirai)", "value": "d4b647226c39ea7dca0022270dcdf4f5ba0c6510cafdd1b0abad9da159f9a826", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646840403, "uuid": "f2c2ec50-a42f-4cfd-a7f8-ac1f814b8419", "comment": "Malware payload (Mirai)", "value": "87f1d42ad9847f5d50c01bfcea3f84c7e4bfddb2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646840403, "uuid": "250a2d9f-ed58-470d-8dbf-6cbf9ee62c22", "comment": "Malware payload (Mirai)", "value": "467199bf3f11eb64a388ae2bcc1cb7ca193adefe09159b5efb3889e42b5004b4e3f4df6d870b3f1394d1fb2821398b7c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646840403, "uuid": "62f5ca0b-e446-4ef3-b195-80d020feeafc", "value": "T185238DA7C43C7DD4D25982B4AD248A3C5B23E016A6933EF5B64785628047EECF60E3F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646840403, "uuid": "69180fb4-894c-4978-b7e7-a7751c37c6c9", "value": "768:X/eptstaT85n1OqaRwtg90kiOqZrKpfPGMQZqN5nj3SLKKCOo6hO1C22E:X/6s+YJaRwtgZ+KGS5jCeKSGO1C2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646840403, "uuid": "befbb4f5-e3b8-4acb-b60c-dee640d05415", "value": 47568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646840403, "uuid": "74338689-2223-48e7-9710-112fdccc11f6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646840403, "uuid": "7bf1953b-aa87-4701-8e64-0c505a714c21", "value": "ad572f145fb973425e8e6210ab4fb2f1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0e1ce44-9f8b-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1646818259, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646818259, "uuid": "4845634d-6f48-4bc4-a34c-4038a009b4ff", "comment": "Malware payload (Loki)", "value": "fbd215c9b15bf48ccad3b4401f17c04c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646818259, "uuid": "220947f5-3d1b-4664-b06e-add4e70b391a", "comment": "Malware payload (Loki)", "value": "d521b184469177913fa221263f7ac3efe041d5ca02ebe3e3882bed49c67ec1a3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646818259, "uuid": "a459d3e5-785b-48c2-99db-4fdf86e6b2d3", "comment": "Malware payload (Loki)", "value": "207a2e5144de925b95ee571da3c6bbb0fd6bf328", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646818259, "uuid": "9a4995c9-b707-4632-b96b-2ecb1f592227", "comment": "Malware payload (Loki)", "value": "22f607b11f80a9921e4f880bcb18993ef4706e3d0f93145f84eb3cbfca591c73c8ed9270f8464a51a323d23da4df43da", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646818259, "uuid": "1ff3dc9b-6026-44ca-a9a1-2d867c6176ae", "value": "T101158DE629EF505DF3379BB12FC8F8CE996AFA73151A20DB10912B764423990CE21735", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646818259, "uuid": "20429372-91dd-4423-9a48-83296165dd96", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646818259, "uuid": "f0d066ff-e03c-4907-8941-0dd19fa21f89", "value": "12288:uZt3Zy3WD5kPSjiQKfKVBnSRQeAOB3tCsywUeJQgHKo8Fv/uFlGlAvBI:QD5kL/fKVBnSRYcCX1zxo8Fv8GlCI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646818259, "uuid": "3b7917f1-042b-4def-ba03-467ca2914e67", "value": 879104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646818259, "uuid": "06502929-428d-4c94-987e-006431917d41", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646818259, "uuid": "8b07f015-3b74-4729-8869-b4b4d376cc19", "value": "csrss.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9231ae93-9fa1-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646827683, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646827683, "uuid": "541d0157-dbd6-4305-8468-0888b1ff3a73", "comment": "Malware payload", "value": "e1b4154300eb6dc39e7cf8ebc12dfd8a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646827683, "uuid": "fce74405-e46d-4587-9d97-aecedc5365d4", "comment": "Malware payload", "value": "d5b7f84c7c175062080224e2f59709dd3d972cdce2a60ab02d0adf7e473eddc3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646827683, "uuid": "1fa529c0-3812-4210-b0eb-022428250649", "comment": "Malware payload", "value": "aa4bb8bdb716be4c6d78ed437d7141282558be22", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646827683, "uuid": "33f2746c-23d2-4946-9d40-5b7ee81b77f8", "comment": "Malware payload", "value": "95fa6741db810517305fd2f881400772fffbdb34c5d0ae3380e985e4e2ee302897b56aa9a7d393c4f906f473caaa1247", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646827683, "uuid": "41f8524b-92c5-47d3-931e-4df6b495010d", "value": "T1CA75010238559164E87E73F1D46E90FE0BDEBE725461A85EA3E03E214F70A50EB2C797", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646827683, "uuid": "34f4cf1a-f2f3-4f2c-a198-2b460c4e2899", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646827683, "uuid": "151f2066-f841-43fe-a526-654fecbf6e9d", "value": "49152:0eeeeVeeeeeegeeKVe3FJR4ck+b5kMJB7BBcJE+Q0OFvfClxg0YEL:0eeeeVeeeeeegeeKVe3Fk+VDJBdGJEa5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646827683, "uuid": "a1f39d7d-eedc-4280-81e2-05f95044c039", "value": 1582592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646827683, "uuid": "1a2e0380-b497-41d2-954d-4e48f9aec603", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646827683, "uuid": "47bf3067-3218-4662-887a-5319448756f9", "value": "blacktraff.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5f0d960-9fea-11ec-9275-42010a9c0029", "comment": "Malware payload (Quakbot)", "timestamp": 1646859177, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646859177, "uuid": "fb1fbc9d-c000-4a09-a5d4-8de6450a7935", "comment": "Malware payload (Quakbot)", "value": "f46e201bb0916fccc71f51a258700664", "object_relation": "md5", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646859177, "uuid": "6bf28ddb-9fc5-4c34-b854-dc6f55e09d6e", "comment": "Malware payload (Quakbot)", "value": "d625d6bb8fa75611966eb29ec7386c58dd25c73dc1bffbb993d38443a198b7ed", "object_relation": "sha256", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646859177, "uuid": "2e708ae5-eb70-4605-92cc-9e22e210c96f", "comment": "Malware payload (Quakbot)", "value": "58611fffdc2272ccc50ff2dac3979f1954974331", "object_relation": "sha1", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646859177, "uuid": "e7f8e52d-a9e5-47d5-a835-bd39732d8d3c", "comment": "Malware payload (Quakbot)", "value": "e2ecc981bb22133d7dffd934c16f09fbb78268362e356c1e90ace7af9b90aa82dd9a792dcc7b0cd6e29fafe51eb10df2", "object_relation": "sha3-384", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646859177, "uuid": "65526fdd-1b73-4a1e-b994-5d135d60ac45", "value": "T18834D092859555B6D1EEAB7023424CD1C1BF306AFC0AE816178353FB3A022F76D992FD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646859177, "uuid": "4accadf4-c90f-4972-8887-e0995680f5d9", "value": "3072:tV5YTPZav/2I01sV03b5R228Driy4EtLa/3WumKrDMzzwJS/wiv+jfcxmpOX3gLw:tV5Eusjr222+yXNQ3MwwdofaVE2/R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646859177, "uuid": "09d41715-ed1a-45fa-8334-937a911dcaab", "value": 239374, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646859177, "uuid": "62ae9019-7172-4233-af11-8379a7d43778", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646859177, "uuid": "62d88de1-47ee-4724-938b-ac1e4bf5e67e", "value": "lbdaoliiurssoa.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "876307c3-9f9d-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1646825947, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646825947, "uuid": "02cbccd0-29a5-449b-b46f-6e0e237cca07", "comment": "Malware payload (AgentTesla)", "value": "04b14d172e59c85499744abeb6af90d5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646825947, "uuid": "2312d30b-b9b7-4b33-883e-ae9ecf963fff", "comment": "Malware payload (AgentTesla)", "value": "d6e5f1e82e5820ce9515c472dc1b475389d729071c69b076331c5e9f0f8520d4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646825947, "uuid": "c487a29a-a3df-4870-8b03-2cd9ee573568", "comment": "Malware payload (AgentTesla)", "value": "61596146aaf92c1cd4e2b5afc9900769ef963b60", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646825947, "uuid": "4d6fd06e-26af-4c22-8373-0cb109353880", "comment": "Malware payload (AgentTesla)", "value": "0e638319b132b1741827358ed5cc8ab2b315262591cc432669562c7d10b776c6904ab5384bb1daae6410f7569b6dea22", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646825947, "uuid": "4c8567d0-4e34-497a-b7fc-9f9fa939cff9", "value": "T1C9F4DF1132B94BA5E7BD7B3425705308BFE5BE62D72BE26D2D86348D01B2B464E70B13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646825947, "uuid": "e753e9d2-6e63-4a39-9d78-c5995a9019b4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646825947, "uuid": "4c92f3e6-7c58-447f-a44e-2807a5d81fee", "value": "12288:FSCGRUcZ64oclF+GuddoML3Gme9Zzu9C9fesFBgol28Ulp/Tp8y/+:FSCcUaHBuXjGxvmC9fxFBk/TpF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646825947, "uuid": "40341654-a8e7-4252-bf02-56fd450ab36f", "value": 793600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646825947, "uuid": "5b8445bc-70d2-44e1-b2ee-5aff3b34d91e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646825947, "uuid": "7e1375b9-4566-43ff-bd18-bb00ee3f8692", "value": "NEW PAYMENT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c9d5680-9f98-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646823781, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646823781, "uuid": "ea80aaad-b76f-4acf-8524-f33af5a25d3a", "comment": "Malware payload", "value": "98905083d8e1701731f998bcde4cea58", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646823781, "uuid": "918bf809-cab8-44aa-ba84-495f046cb9fb", "comment": "Malware payload", "value": "d723b6fbbdc27ad82794e9423187fff4a4f4ced69bfe175f75800863ffedfb70", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646823781, "uuid": "cbef15fc-b924-4496-8511-7034d650f191", "comment": "Malware payload", "value": "e62964354a1909b655342a48b2ee10ece820be1d", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646823781, "uuid": "7aebf368-1c01-4e2a-8fab-f17b63109aba", "comment": "Malware payload", "value": "1651fa6aae8a6d18dca448e4f1f41921e253dabfdd028c2ea8be6964f9beea15f654e00ed6926049acc6ca381726f134", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646823781, "uuid": "0a911bd2-0653-40e3-b7a7-73b85e79cb79", "value": "T151A423841D662FB2E92302B346DF69EE4030755F7627AD5053FF846B1E997E0027CBA2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646823781, "uuid": "b30193c6-3726-4803-9636-a04934fd4c92", "value": "12288:IQ7HWTLXjs/WxVP0I5ItI1kuxikjCgsFIp+gjNmN7yw5+qjGB:J2XQ/WD0I5ItI7/zxUgjN+7/OB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646823781, "uuid": "d540acfd-329d-4c4d-8b53-013522d44e97", "value": 452208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646823781, "uuid": "ca30bef3-48ff-4379-bb15-f6aec5e5bc55", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646823781, "uuid": "d55897e1-526c-45db-8209-fc0fd93bdd7c", "value": "Operativna_informacia.chm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af087b27-9f92-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1646821289, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646821289, "uuid": "9a790c9c-3ac9-4b25-8947-42760b756558", "comment": "Malware payload (Loki)", "value": "c3a2d4aec3573bb6cfbb0267cc3b05e7", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646821289, "uuid": "a8ee3637-2360-4ee0-b73c-9495dee663dc", "comment": "Malware payload (Loki)", "value": "d72c7e2d42261137f55366b9787903084048c4688157f4d76e0392285d104ae1", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646821289, "uuid": "087e9ffe-53bc-48ee-94d5-2ce42bff5872", "comment": "Malware payload (Loki)", "value": "6e86b7c4f355e5d98f3f3db1f86e7c09b9948929", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646821289, "uuid": "31fd56f4-9911-4a6c-a0fa-f6250ad56a15", "comment": "Malware payload (Loki)", "value": "ba62cb6846fda024f4f4ebb0b7733f0d936a44630311705cd4991036b011a64c7768bb63d1d7f9c8f2be1cefa39652e5", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646821289, "uuid": "9cc42876-d91b-47c9-8c5b-5f27a6dad33b", "value": "T1DA0412476412F8A1C962AD7CC5269015E380BA0CD4B5C01DA67093FEBBE92DF5F93B8C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646821289, "uuid": "564f9363-c909-4210-b0b6-a5a2d18f86d8", "value": "3072:xTFYRDyEsfM3jQ29jH2tYiUiL4z3o5q1mTBOQvqmL7faQutBguM/xSVFW6h+g1n6:xTeRmoDNMRUiLqx1gB1paBI9/2x1ngMO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646821289, "uuid": "dcf87574-a3d8-4e83-89e2-ddd27471a96d", "value": 184409, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646821289, "uuid": "0d93cf56-fcc1-4e6a-b577-930addfbf9cb", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646821289, "uuid": "8290f9d4-ad60-4888-a886-cd1177d6b51c", "value": "outsample1.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d62e769b-9f9d-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1646826079, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646826079, "uuid": "90ecbaf7-17cb-4158-80b8-bb10f5e51020", "comment": "Malware payload (Loki)", "value": "2fd20c19604e8be8894f0c3c6f1f7b0d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646826079, "uuid": "1fe2141f-4c1c-4c86-8a41-44d59c83e28c", "comment": "Malware payload (Loki)", "value": "d755710b8e7d2be6c20427719c1aa26d642e21baf8a1857ead26a426271fe514", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646826079, "uuid": "d7d6ff32-fd10-4d58-8b37-172f7455c455", "comment": "Malware payload (Loki)", "value": "ff6bd7ea7e2242689bbf7623ade4cb66baa7ddd4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646826079, "uuid": "2e3c4bec-44a9-4680-a57d-c0b0c88c4afa", "comment": "Malware payload (Loki)", "value": "395c4c039f0aae5b94956cd5ec54b3d1f601b890ec518ead749b63ea0e4d9b4d2ac35336e3d047ac24f1c3e7a9f7cc66", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646826079, "uuid": "2f2d3949-85a3-40ac-9b64-6a5e8befd96d", "value": "T165259DE229EF501DF337ABB12FD8F8CE996AE973161A30DB11521B768423A40CD61735", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646826079, "uuid": "5566ea36-7d1a-4b7a-a942-466435039b0b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646826079, "uuid": "8f6f66ad-6457-46e5-9ef3-f8c93459e713", "value": "12288:o8AZt3Zy3WD5kPx5sGvdaFEIF9VStxazpOIn0LPi76HbTaZ2qUByHd:ofD5kH7QVYxCb0Dw6iZXUBU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646826079, "uuid": "e46546d9-c0d7-4002-a477-9b528be90d21", "value": 991744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646826079, "uuid": "52569726-0196-44d0-988e-5e1f2fcda7ee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646826079, "uuid": "695a2d1c-1815-4c6d-8275-1a1f7abd53ad", "value": "DHL Exp.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9aae11e-9fb6-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1646836742, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646836742, "uuid": "c0c4edcc-fbe0-408b-a166-b567622ce398", "comment": "Malware payload (AgentTesla)", "value": "e234799e3a3078faba11c95a9a2567f9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646836742, "uuid": "a19888ba-1d41-4051-b6f0-21a046000458", "comment": "Malware payload (AgentTesla)", "value": "d7773bd61db0330d2fabc13239749238c677526c45e08e81f1d22fa20fcde55a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646836742, "uuid": "5c32156f-b5ce-4dbf-b73b-cb69f826c39d", "comment": "Malware payload (AgentTesla)", "value": "5df6d31262fcf9d5e4315985c26e5fe88345c080", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646836742, "uuid": "644694be-8cf3-42ac-abdb-0489fc525e60", "comment": "Malware payload (AgentTesla)", "value": "70d68d632bd9d0b5b4a918a73f62593b741d1a3ec73e19cdd6b233c52f7c0dcd8220eeffebdc2cbf2164a5b3cc58961e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646836742, "uuid": "ac01f2ab-f133-466f-91cc-2194aa0a8e6f", "value": "T109F4237B2DE3FA08CA4250668071D42B97E1CD7A1B802949E578CE9276F43FC52339ED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646836742, "uuid": "6c052725-04bb-4365-bacc-168e4287c465", "value": "12288:tqLrYUU1X13dxxWPHKd/Dtm8pjKdOdhAMu+jGGnu+goaEnp2OuCS:UL0lxxWvuZm8sAdh0Iu+M/f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646836742, "uuid": "c3ce09e5-5489-4cb6-a2af-21e32f7f4028", "value": 759743, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646836742, "uuid": "91c7ae6e-acf5-4b06-b12b-0645f649edfb", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646836742, "uuid": "92860b73-8865-4787-807a-a3929222a0a0", "value": "Quotation.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25472185-9fe7-11ec-9275-42010a9c0029", "comment": "Malware payload (njrat)", "timestamp": 1646857565, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646857565, "uuid": "6addc1f7-898e-4570-9f7c-da0c499582db", "comment": "Malware payload (njrat)", "value": "18f60389bb9945e0aa723bd670436c9b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646857565, "uuid": "f1fb8bc8-0b18-4407-9bfd-b2f6959edb6b", "comment": "Malware payload (njrat)", "value": "d7e08252827c9818ad99f6bd0fcca7e07fee21aed2a7219274ade373a95625c8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646857565, "uuid": "41e60274-4d6b-48df-98e7-4d09b2dba6ed", "comment": "Malware payload (njrat)", "value": "a332f86a93f3fdf728febdca63bc9fc9b59ad853", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646857565, "uuid": "24c77c3c-0834-4e9a-aa5d-5b052f67839d", "comment": "Malware payload (njrat)", "value": "8277a7c80f3148de9c81de81afd93176c95b2af852e7b1625ec7dd832d86e244c409dbf6a709fdc6a6ce9c575e9599be", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646857565, "uuid": "1e9b810c-7d02-4fb6-9437-ced95b1af3ad", "value": "T1E8E22A1DFAE18421D0BD1E7509B2E2240FB4D50B6113F65F4ECA68EA3B373D94B059E5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646857565, "uuid": "b2354c72-7115-4128-8e7d-590eafd003df", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646857565, "uuid": "14f4e92f-53bf-41c5-901c-f98786f3e293", "value": "768:YpKu4Ad2LmwMVeOkclNMzE5QC/leq3erdjm:lkHVLv+U3n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646857565, "uuid": "597ef36b-7684-4522-8670-f2006635a266", "value": 32256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646857565, "uuid": "d1cd2614-d691-4a3b-abfb-75f951b189e6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646857565, "uuid": "a1bacc51-8fa2-43bb-b679-1228ff541816", "value": "18f60389bb9945e0aa723bd670436c9b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9933e60c-9f46-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1646788610, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646788610, "uuid": "a95f4b18-efec-4490-9bef-2a111fcdc10c", "comment": "Malware payload (Loki)", "value": "4ef68cc3b72b4505c633bf6831e1370d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646788610, "uuid": "fc05c6c9-c15a-475b-ad85-91e4e936f760", "comment": "Malware payload (Loki)", "value": "d8ac2116303d1c28417b692db2a7b9102c9d1072b32a1a2679f4df3806b301b5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646788610, "uuid": "08e0dad1-558a-46c5-b9fb-21b1265d8783", "comment": "Malware payload (Loki)", "value": "2e8a3929924272cfce10228e0e4786bbdba2528c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646788610, "uuid": "1882d50a-c912-4c49-a959-0e77a75f98dc", "comment": "Malware payload (Loki)", "value": "bd2cd0a9007805f93cf6d3383f75807690bfc3fde388d45c617d65f0bc89298abc777c50c43d394628ebe37dc988f87b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646788610, "uuid": "b35ed33f-a224-45d1-94ae-1c80f5ca1a15", "value": "T172158DE629FB405DF377ABB12FC8F8CE996AEA33161A30DB14911B364423990CD61735", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646788610, "uuid": "15c548f2-46c0-4bad-a6ab-060a95cbc53b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646788610, "uuid": "f57fbb82-9b6d-4cc1-8470-fb86e1b4a2e3", "value": "12288:sO35Zt3Zy3WD5kPnPcnOvLun2U2y1YLnhOjdoBg8eroct0rbvq5Fv6glN7M0t6pI:sO3VD5kfPvsL2y1YLnidoCn51LbM0EI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646788610, "uuid": "1ac8e00d-2677-4998-b805-7783b9a29fee", "value": 901632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646788610, "uuid": "011e0c52-9107-4573-beef-f7a6568eb1bc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646788610, "uuid": "39928866-af71-4e9f-bde3-a7ce2ab165e6", "value": "New Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3eee2ae0-9f8c-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1646818524, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646818524, "uuid": "cac13bb5-cbe1-42c7-bf25-6cd42e7ff5aa", "comment": "Malware payload (Formbook)", "value": "a936ed7d67cedb422d66bc363755f2c3", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646818524, "uuid": "6821f5b3-ff70-4814-bc41-daa244d3629d", "comment": "Malware payload (Formbook)", "value": "d8af905de93934235d5396922ab317414007b633b8f47559df3d7564a697c315", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646818524, "uuid": "28b97259-de4a-4d57-a98d-9f0b6a157d83", "comment": "Malware payload (Formbook)", "value": "8591b99f7ac7b164fce40b03377f0f643581e154", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646818524, "uuid": "1c144693-63f8-48fb-b71a-02ba874b89bc", "comment": "Malware payload (Formbook)", "value": "5c6cc1f9d86228dcc9eda4850bbf18c7cdfbe836cfcdf2133b5d829e2d56b3d9d0067d1a442b7b559bb5875ecbce244e", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646818524, "uuid": "1874f865-7e26-442b-b92c-ce1735fb77a2", "value": "T1CEB4239E3A413164B187D487BC5F939C717EFEABA58878F9DB02918313211AF68C3B50", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646818524, "uuid": "3f65b0e4-2f0c-4eac-a969-23d951f0d899", "value": "12288:kv4Yk3PfyluufnYcmifljFNIRd0LJ7Lwm/Y:kAjyoi1O0LJndg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646818524, "uuid": "d054c312-ab91-4b3e-871b-78bdd047263d", "value": 522173, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646818524, "uuid": "b5b03f39-7be1-4723-b8f5-b60d3164f5ef", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646818524, "uuid": "15ba361a-27d7-4a2b-b543-61170017a12b", "value": "SOA.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42c858af-9fbf-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1646840434, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646840434, "uuid": "761a282c-4972-4da6-bca3-01108780fa63", "comment": "Malware payload (Mirai)", "value": "99d59901796fc711c114719f646157c0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646840434, "uuid": "c99c34dd-327b-4b99-8a69-2617b6b82f65", "comment": "Malware payload (Mirai)", "value": "da29454338666f93735709ce697cc437beffa2ad2dbbbde4472803d94a16696c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646840434, "uuid": "4a0969c3-edd7-4722-b41c-2755958c1906", "comment": "Malware payload (Mirai)", "value": "83c02fe9436580964a850f91a8dca982c0725e3b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646840434, "uuid": "22f513c9-07da-4716-947a-517a6fe32a9c", "comment": "Malware payload (Mirai)", "value": "8d19f4cca01b27b52420634d883aed645e65b8b5469fa9e410f823495b000350cbdef36c6071d1e977ec58366b4fb9af", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646840434, "uuid": "857f7067-3f20-41f8-bddf-4d5838624f38", "value": "T11E439D67C47D7D90E14D82786A244A38AB13E40692937EF9A78A8B735047FECF5093F1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646840434, "uuid": "2e0ba7bc-6986-4a61-8075-170e368acd19", "value": "1536:gw/VaJc5aXwtL2xu3uV+O4E841Lc/+5vCi:RNsoEpu3obG/+5v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646840434, "uuid": "bb30c59b-f589-4513-9c53-501fb3ebb772", "value": 55372, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646840434, "uuid": "849069ae-919d-4cd1-95c3-4f6cf1fcf4fb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646840434, "uuid": "2318be50-6dee-4041-83e0-61290fb74b09", "value": "99d59901796fc711c114719f646157c0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e1a900e-9f99-11ec-9275-42010a9c0029", "comment": "Malware payload (QuasarRAT)", "timestamp": 1646824079, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646824079, "uuid": "70eaefbd-24c6-4d65-9bee-fb819397ce7c", "comment": "Malware payload (QuasarRAT)", "value": "626c4356573ed5f69bc6303664dec68b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646824079, "uuid": "428db583-dbba-4fde-8153-d50bace4b955", "comment": "Malware payload (QuasarRAT)", "value": "da6d10f762f019e36f8a2f8547bb4fa33ec67d508db580b6c5b156a1e1dc576a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646824079, "uuid": "a7894486-3907-46b3-a515-d6e59afa24a9", "comment": "Malware payload (QuasarRAT)", "value": "b002c16460e77be617fffbb48036f9ac2e41e9c2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646824079, "uuid": "e61e7042-20cf-49c5-b2ec-3f81c3269985", "comment": "Malware payload (QuasarRAT)", "value": "75a53430079884474d335d436d45e09bd69aaffddc14120c8a8f40404895ce6553ce86bd2a22924cde1384eb28830ee0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646824079, "uuid": "a2c8b580-e547-49f4-b6e3-a012e52c92df", "value": "T14194389413EF41A9E2AF67B4FCB13624AAF1F826B1A7E75D4580B1F56C52B20C940733", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646824079, "uuid": "37daa349-398d-4baf-a034-ec388cf42163", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646824079, "uuid": "532569a5-277c-4774-bdf3-ee05f696e776", "value": "6144:MTEgdc0Y8XAGbgiIN2RSBeII7HbOkQgaezUUXxnsbCuxTcTR3N:MTEgdfYGbg8OwjzJnUxTcdN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646824079, "uuid": "252c9aa6-1cf0-4bc7-8a8a-38f79abb6c25", "value": 417280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646824079, "uuid": "cf65d59d-c7af-4ec0-91df-08fe9cc3740f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646824079, "uuid": "ffc7633a-4951-4042-b50c-7e694b1e87b7", "value": "cnmainobf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33ac2c6b-9fc4-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1646842557, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646842557, "uuid": "3f606c49-4f27-4354-bbd7-b0f1e46fcfec", "comment": "Malware payload (Mirai)", "value": "3920549cc1aab2097cc646b62a2929c1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646842557, "uuid": "57a72283-e04c-40a4-bd42-66a68e188e97", "comment": "Malware payload (Mirai)", "value": "da72f0e8262264a98f355476512b88e6288facb519f9e77e4718e411c5ba0a09", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646842557, "uuid": "6040d1d9-c92b-4630-b8ec-c112915b07f8", "comment": "Malware payload (Mirai)", "value": "cd8a3ef12e43285d75bb89b542bb4e6d9542e541", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646842557, "uuid": "46d1d4a3-82a4-4e8b-94a4-2c536ffe75db", "comment": "Malware payload (Mirai)", "value": "343a49fa0b929f615faa5f6db77ab072e39eab4d47156b276e2574cc81e41ea0878156dbe1523e76b587cfd741b7a3bd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646842557, "uuid": "5d09ff76-412b-466e-8571-2c20e715cedd", "value": "T18323F225E4E85495C6E8BC30A8FCDE4932962EE4734CF1A1663182D1D9C79C372FA4E7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646842557, "uuid": "2e518f31-174a-42c7-ac57-c31aeb047532", "value": "768:ZqPb4YOTeTx9krjuxxu0BszWd2FFq2oKeWh8aq3UirAT2UemnahFIS0BWOPW9+/:jTeNCCxjBjd2FA2FevhU8t085o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646842557, "uuid": "19397c08-8bb4-4258-a5ce-468d5eb13279", "value": 48664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646842557, "uuid": "f6c70326-d5e0-4c0c-b5e2-cb374ddf8596", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646842557, "uuid": "46be34bb-37b8-47be-a4cf-504b7b8fc64f", "value": "3920549cc1aab2097cc646b62a2929c1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3cc9f48-9fd0-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646847926, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646847926, "uuid": "026b946b-a29f-4b9a-baf3-a74d079755c4", "comment": "Malware payload", "value": "0d06882ea6cbb0ddcdb6728e3438b923", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MBR", "colour": "#C35BC9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646847926, "uuid": "a75334bb-d66f-4fbd-9c6f-32c55c7e6bf7", "comment": "Malware payload", "value": "dbcd97dc493340c2cb3f1f32ea0217e01ab76e29debef940b3225424f98e1ade", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MBR", "colour": "#C35BC9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646847926, "uuid": "d798c2e8-5847-41e0-b839-e683c62c6b85", "comment": "Malware payload", "value": "bab7f39dedfbb487fd21b01640a40f12d55b461d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MBR", "colour": "#C35BC9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646847926, "uuid": "770bd966-e15e-431d-a7d7-e88ddd6475ab", "comment": "Malware payload", "value": "c2e0d4315dbad93ebaf38d935e7c1db0f3215ccea338c957a71cfa5b3f4ae8be57203e6e13515ab8ba4ca2095a21443d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MBR", "colour": "#C35BC9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646847926, "uuid": "545e0040-497a-426b-9fc5-802063d2ff38", "value": "T1F0137C17B6D28036FE21CABC1C30B119BBBB3D341EA24979677409CDBDA67805968377", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646847926, "uuid": "4b168e05-8784-4734-9134-d28544851377", "value": "2eb5df5b45c50972ac7b7cc3a94455a5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646847926, "uuid": "8fb3db6d-4f3e-4b74-a1c9-028ec33b55c6", "value": "768:wp8Nmw4uE5tzzUky7D6baLOg9vXaofvaU76gi4NtLvUFYsv8x:wQ50Fy7D9pXaChtMFXEx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646847926, "uuid": "79727f01-5bc3-49d3-b65a-d3e402a06e9d", "value": 41472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646847926, "uuid": "94d9f4dd-c2fe-430f-be21-743b77a385cd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646847926, "uuid": "f56a8165-9061-478c-b395-fcfd38cfb4e0", "value": "dangerops.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d48782cf-9fb4-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1646835955, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646835955, "uuid": "84061940-1fc7-4983-96fd-656d2f645f9a", "comment": "Malware payload (AgentTesla)", "value": "d04c795978a3e0d7e1782dac51716945", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646835955, "uuid": "32dcd979-045d-4c76-9831-7321d4599fab", "comment": "Malware payload (AgentTesla)", "value": "dc3d873347a61b4d83cec98c00a3b59cb174e7d00d2e458fc004c55ddc6cee6b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646835955, "uuid": "7dcdb14f-a978-4083-a29f-32ec51f131e7", "comment": "Malware payload (AgentTesla)", "value": "55b25c116239dbf5430b6f425d163c2772887891", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646835955, "uuid": "2961fd87-4cc9-4e19-bae4-f75dbdbd5c7a", "comment": "Malware payload (AgentTesla)", "value": "14cf414d52f5f61f51ab022731d9a51531df1b494436dd61227f00763d2fcaf05fe1937858aa9eb9180493e38be5ed6f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646835955, "uuid": "465f0497-6e27-4952-82a8-5b0e14dd75e5", "value": "T166B49C5632BA5A95D77D7B3414705308BFF4BE72972BE26D2D86348E00B2B064E35B23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646835955, "uuid": "d0b59a38-928e-4b53-84bf-de764cf45940", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646835955, "uuid": "452abae1-bc71-45ba-98e4-83a994808cab", "value": "12288:7ZVGRUcZ64Ec0AQvzga+oRuA+Q0oecKRlNPk5:7ZVcUS0LD+XA+QLJKHNPk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646835955, "uuid": "c70382eb-53c9-4a1c-842f-0f1f5cfd15e0", "value": 536576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646835955, "uuid": "d788584e-86d6-4bf4-836e-dbd187122b14", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646835955, "uuid": "2756ca0c-3d08-484e-a0dc-df5d11e6ad66", "value": "Proton SOA-EUR12646.05GBP220.6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f78a235-9fbf-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1646840429, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646840429, "uuid": "4f7d0871-ba4d-47a1-9969-a1bb76ef59ab", "comment": "Malware payload (Mirai)", "value": "9de7ca4601ca332256af8d0ae7a042e1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646840429, "uuid": "01e1147f-12ee-485f-a667-4de6d9d50b83", "comment": "Malware payload (Mirai)", "value": "dca3183b502f1ae376e2f6a80caced25f2875ea288ada4430b19e06d91e3e1ca", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646840429, "uuid": "7da326f6-f9b2-4d3a-ae02-a0961d2aa830", "comment": "Malware payload (Mirai)", "value": "39284b0c587cbaab0aa9ab2d13bb06811ef64ac3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646840429, "uuid": "b95484e8-99b8-4953-b0b2-f4ad5ff71a06", "comment": "Malware payload (Mirai)", "value": "8964210fbdf78e92a8ac0f879a867dde0c682bd15693d5e402669c78a826703b8dac1fb8a22568630d1a90bb7396bfa6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646840429, "uuid": "f3199cb4-3456-4999-93c0-fdb802caff52", "value": "T1A553F946FC818A01C9C513B6FA2E118E33136379E2DF72129E106F6477CA96F0E7B952", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646840429, "uuid": "aa90e065-b0f8-4d63-9ea0-4538dd59cea0", "value": "1536:85n1zbm9tjbQAYmmEwMSPWhQczKuwknVnC0WZoLJI8iwPZFZWh7:8z6MAXmhbPWOczKuvVCsPZFZWh7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646840429, "uuid": "81138259-092b-4a9a-a43d-b0d40d2c7008", "value": 63180, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646840429, "uuid": "99cba63d-c996-4f4c-894f-5e593ddb4797", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646840429, "uuid": "5bb39093-730d-4ee5-923e-f342054118ea", "value": "9de7ca4601ca332256af8d0ae7a042e1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2fff7c0f-9fa4-11ec-9275-42010a9c0029", "comment": "Malware payload (DanaBot)", "timestamp": 1646828807, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646828807, "uuid": "a2482bbf-dd6a-4e97-9634-020ac35963c3", "comment": "Malware payload (DanaBot)", "value": "e712dec65bd1bd4d6ca416a319ca231a", "object_relation": "md5", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646828807, "uuid": "76836395-a250-4402-ad03-5def3f1687b1", "comment": "Malware payload (DanaBot)", "value": "dcedf234c0f9d6fe3a4392693c82708c70c8e243f42f2e7073d35bd928f3b526", "object_relation": "sha256", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646828807, "uuid": "66f91692-1bfd-4ae6-ba91-731d28ae476c", "comment": "Malware payload (DanaBot)", "value": "5681829d6b0d529c62609c15304286fd357410d7", "object_relation": "sha1", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646828807, "uuid": "77b17628-b418-4b19-b420-0fcca3b120be", "comment": "Malware payload (DanaBot)", "value": "fb633587d54dfaa275c42d69c817526809a741aa7f0b80338c265d8a86b00b2fdcf7875b4bf76bd12706c10a0a406cb7", "object_relation": "sha3-384", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646828807, "uuid": "d9e6525a-a6a6-404c-aa2d-27166072367f", "value": "T1CC451210BAA0D035F5F711F955B997ACA62E3FB1A77404CF52D42AEA02396E1EC3131B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646828807, "uuid": "fc04ab4b-3086-46a3-bd28-4fd96d026a99", "value": "da87ed787b504389105de3ab7df646d4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646828807, "uuid": "3b5a657f-ce10-4845-a478-6d1b5c0ff1e7", "value": "24576:qLZ1Yf3Iu+eZojDTNOQOqUZfuNMkGYodQw5mKNZbcctOlOY+W41yCRij5yynncDQ:qm3IuTZ2X1dKNBBtOlnk1QcycD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646828807, "uuid": "376fcd70-3363-4d87-b017-5ec8300c6575", "value": 1224192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646828807, "uuid": "4160b330-2aee-42d1-a814-2c7c1ef12cd1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646828807, "uuid": "fa63f314-ca5f-48c6-abf1-d46985c933e2", "value": "e712dec65bd1bd4d6ca416a319ca231a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10e29f80-9fd4-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1646849370, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646849370, "uuid": "e9f81611-59f0-4870-94a7-dcc17aba2a9a", "comment": "Malware payload (Mirai)", "value": "31c01b53c98951ec666e5da544a1ac70", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646849370, "uuid": "3448b02a-7557-4e05-8388-6247ec699e46", "comment": "Malware payload (Mirai)", "value": "dcf22c84137c616e41ef43863b696089aa7af0f25ef9c0c133adf069d69a404b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646849370, "uuid": "50a38192-e8e1-475d-b89d-f3dfd6c6f160", "comment": "Malware payload (Mirai)", "value": "3806c67653d9e180dafce893a502891a187b9928", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646849370, "uuid": "97018b34-9b6f-46fa-8d09-88ac76b41b68", "comment": "Malware payload (Mirai)", "value": "8efad53895f8fa2887bbf417fa64d5a504562fa7a681644fbf803dfb46f77c1ef9362db695cb8b681eed5fab9c33c01b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646849370, "uuid": "861af25a-9789-40ec-a46b-c78a46619b13", "value": "T1B193A309BFA05EF7E8AFCC3345D92745288D655A21A83F79B930D928B21B24F15E3C74", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646849370, "uuid": "609ee628-b698-48a0-adc6-cdfff08ea117", "value": "1536:a5DnSB+v5XjQm2F17xk49d6xZLu8vJ4TGo8S:a5TSB+v5XjQm41GFrvhrS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646849370, "uuid": "f3fbde5e-a187-418f-8ba5-ac92f284a254", "value": 92512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646849370, "uuid": "c842799c-5e37-446d-8f15-62da537c4ce9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646849370, "uuid": "383ec026-ba5d-413c-a084-c54c477e5d9f", "value": "31c01b53c98951ec666e5da544a1ac70", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aebee417-9fb5-11ec-9275-42010a9c0029", "comment": "Malware payload (Socelars)", "timestamp": 1646836321, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646836321, "uuid": "458dad2e-18cd-4f0c-8cae-d2a36c10bce6", "comment": "Malware payload (Socelars)", "value": "5c55eb4c12fe7285e613aece0e721221", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646836321, "uuid": "ff997d20-8dfa-4750-aaab-212a6e6aefae", "comment": "Malware payload (Socelars)", "value": "dee7322f6c8bc9b36f577a6c1c54e18848bc9e84afa978ebde4cd0beba9fef7e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646836321, "uuid": "21d779b5-bcf9-46e2-8d9f-841fc6b9e69a", "comment": "Malware payload (Socelars)", "value": "7d6234348d120268d86e46666cb1fce71d131bad", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646836321, "uuid": "b7270dc5-3ca8-4ce3-9fd5-77d7e9a39cd6", "comment": "Malware payload (Socelars)", "value": "9dccc6b8a6d8c29d04bc5653712ad76e4c5cd8ccb77adfe0de6e5705942117e72b3bda6148cffe75b809f96e9d439d1b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646836321, "uuid": "14089411-5d71-41cf-ae71-17968dfaf145", "value": "T1DB659E11F6425036ECE310B3C5BF4AFE8D687E21031494DBE3C47A6A5AA15E33637A5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646836321, "uuid": "e0ccb73f-2650-422b-884c-5a7f79484e83", "value": "d69e4c13e25f0ad622344ac56118c0df", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646836321, "uuid": "2115c1f9-d660-4eac-ae73-16ccbdf052ac", "value": "24576:zKAgpBGV2HpWHuREjDnI2AuADZ8KvqC7mH2dtDPc/d3KFyYg:/gpG57R8jnDPc13KMYg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646836321, "uuid": "010b70a2-bf0c-4df3-a982-03ae916d2b2e", "value": 1522176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646836321, "uuid": "5cb1f826-3fc2-4183-bd40-2ff6cd5029b5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646836321, "uuid": "e4e10319-fff3-4819-82fd-a85057a6891e", "value": "5c55eb4c12fe7285e613aece0e721221.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4899d462-9fb9-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1646837867, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646837867, "uuid": "86c5046b-9353-4dfe-ad04-f11b1dcbe386", "comment": "Malware payload (RedLineStealer)", "value": "f427b22410ea77c1a00066855480f805", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646837867, "uuid": "a14d065b-ea2e-47ee-aaad-63b0c134f87c", "comment": "Malware payload (RedLineStealer)", "value": "e05a3479cc1be3582990365a2d27c15ac9b71887540a669f3ed824dbb380e6c4", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646837867, "uuid": "4cc2fed9-cd0f-491e-9d57-3d3dd01ef0b0", "comment": "Malware payload (RedLineStealer)", "value": "1966b280eed236c24f346b07bacc7f6ba69f6271", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646837867, "uuid": "2280c337-8579-426b-ba7f-550e8bc2bf8e", "comment": "Malware payload (RedLineStealer)", "value": "3c9df644a02c543cbc0eac8ebe9a7f8071e4349112cd1217d7597b45d87de28b2144e17c39d7c2180d3e76ae21738b4f", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646837867, "uuid": "a0970589-7ca3-4aed-b66b-76172f36c24a", "value": "T142A1DA3ECB71F8C0436D7290CA581D6B20C50D23EBB36E68D6012DB21D747A9CF3A688", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646837867, "uuid": "250e71c3-18b0-4bc1-9664-44eef6afa046", "value": "96:oZG/Y3GN6JPBrHGeIUOzGVJgUM6yruBNTgEM8aKfi+MtNc4gmCgI6:oZG+GqPBLILCVJgwKuBNEyBb4JI6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646837867, "uuid": "a6a94f4c-d2b7-40a0-a015-08420e0a86f9", "value": 4996, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646837867, "uuid": "7f29c98c-b513-452c-8f95-ed3a44eda992", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646837867, "uuid": "8ed2d3c3-9301-41f8-bcec-9956f02ba8c6", "value": "powervbscmd23redj.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9aa1df9-9ffa-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646866001, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646866001, "uuid": "8933a411-1bf3-4be5-b947-72993cb0c89c", "comment": "Malware payload", "value": "e7ce35c207a7d0b9720c2f013a2e6bbf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646866001, "uuid": "ad7b0777-ada8-460a-a9e5-855f5bbb7268", "comment": "Malware payload", "value": "e06901162a4092b2777eb96496d6da3a21ad2b0d98a55bb964ecda4db2449c71", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646866001, "uuid": "127bb91c-b7e2-41b3-ac73-4023c94fcd32", "comment": "Malware payload", "value": "d17b719a1c4ec0bfa4e6635ec50f95c3943ae466", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646866001, "uuid": "24a00429-d3d6-49b6-824f-b794f07661d4", "comment": "Malware payload", "value": "f1496ad805eaeb85283e6b2236e17bb44dafb2ad14c8e83f86f6ea316e97da73a14aeb4d251d7092f5c589dd09199898", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646866001, "uuid": "f8f96715-9ee0-4702-be53-7e89bf101e40", "value": "T1A073BE42D5C40476C262127E17753EB99A34F1FA3716C1DB768CCAF5DBC28A0A6363C6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646866001, "uuid": "6fe249b8-1afa-4da0-90f6-e4b19894dc8d", "value": "481f47bbb2c9c21e108d65f52b04c448", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646866001, "uuid": "eb28629d-f000-4fa5-afd4-8607c593699d", "value": "1536:ImdZYaQIqKDklrV4/Apx1EeV/Mb+KR0Nc8QsJq39:XHY07klrYAJEO/e0Nc8QsC9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646866001, "uuid": "e9c93219-aa11-4baf-a903-6070b6c8240c", "value": 73802, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646866001, "uuid": "d2bc883e-9784-442e-bddd-1c7ad0b18a9e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646866001, "uuid": "13d0bade-bc21-4c2c-b607-401c9406d980", "value": "endtheline.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44001fdb-9fb7-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646837001, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646837001, "uuid": "15598a22-0520-4354-8e1d-c938095a1f9e", "comment": "Malware payload (Heodo)", "value": "3fea8cd350f2d58112256104a0e42e90", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646837001, "uuid": "e34eeb74-665f-4cef-8993-390f5bc44dab", "comment": "Malware payload (Heodo)", "value": "e0df6c118c8b80baefbcd967c60af5e51fe0ad7f66038d439ba351de25176ed9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646837001, "uuid": "8db58c44-921f-4be9-bbbb-d89960727fc1", "comment": "Malware payload (Heodo)", "value": "6d93a027291671dfb2724f65d66f2896fce67672", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646837001, "uuid": "cd3d3489-39ae-4fe6-800c-d3e3f7b10e68", "comment": "Malware payload (Heodo)", "value": "0127db773ce28e43c33a5f8c8f470a79fe4d25e40d9907d89ea0034a1028b4489d1648b152130949ebf364154aec5dc6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646837001, "uuid": "ebdc99bb-5020-4dcb-9a2b-0a2e2dca9a74", "value": "T1C9257C107E8A817EC71B85B30836676D6FFEAB204B6CA1CB478175ED2D316C29B36705", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646837001, "uuid": "94e9ff6a-7c38-434d-b2d5-e503c8b1bd4a", "value": "087c9809507dfca4c3283e6c7539e91c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646837001, "uuid": "1e8cc93f-caed-468a-ac60-7c8c891bea5a", "value": "12288:cR5SOyRHiA6m0OcElLzt6JtcS1j2xKkr:cR5SOrKlLzEtcK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646837001, "uuid": "9cdeb70f-921f-48b8-9e40-70cd3f34cf64", "value": 1040384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646837001, "uuid": "85569776-7945-4630-8ffd-8b901f9547d9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646837001, "uuid": "4f3c1317-0f32-4ddc-9ea2-1bb6a768b07b", "value": "3fea8cd350f2d58112256104a0e42e90", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8bc48fcf-9f9d-11ec-9275-42010a9c0029", "comment": "Malware payload (STRRAT)", "timestamp": 1646825954, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646825954, "uuid": "10789614-3896-47b1-a629-2566528ed372", "comment": "Malware payload (STRRAT)", "value": "0eda939ef0a9dca59ec0320f37e712e1", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646825954, "uuid": "5cc731b5-fe53-4827-ac64-673f5b371ef6", "comment": "Malware payload (STRRAT)", "value": "e0ef59668fce50353ed15c79a80d47343be9f188a619e022f177cf926a5adcbf", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646825954, "uuid": "0c2ad766-4f4b-451d-b134-53077168c722", "comment": "Malware payload (STRRAT)", "value": "988ee13def8ef52f5198b60def8daf7afb154a7b", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646825954, "uuid": "6cd51e84-5869-4c08-810d-fdf7c3cb77f5", "comment": "Malware payload (STRRAT)", "value": "781a23c83efb98c47b7def2f41c0dca630d19e8f3c22a37444021dcdd10232a125d7f9b1be7bfb183d43b32d424ca43b", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646825954, "uuid": "0b379d95-57f2-4110-91a5-e9acba4277ea", "value": "T1390412629059020EC312436A979BD63C8E63E7E517EEDA8B1507FC0ACBDA40CCB5275B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646825954, "uuid": "2de9c13a-95b7-474d-b8b2-3c2c5a8ca8ae", "value": "3072:SdjKebjuejV9U1ceRc6NLiQOVols2DDM52cdLfAA7yki:gG6V9jSjNhm2HDMld8cyki", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646825954, "uuid": "0674ba58-213e-4718-986b-5793af08ab81", "value": 180141, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646825954, "uuid": "00b452f3-54ea-477d-b63a-d8cf373a5498", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646825954, "uuid": "71d7d130-ab99-4aa7-9fb7-4154d8634606", "value": "PO#BC220402_1.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed173aa0-9f8d-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1646819245, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646819245, "uuid": "e3351532-aac6-4ab9-a2b3-6c40b29ba4a8", "comment": "Malware payload (AgentTesla)", "value": "4fbc354570665f02c821da88221a9fcd", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646819245, "uuid": "4c55dd40-e21b-44cd-bfbd-b544979788c5", "comment": "Malware payload (AgentTesla)", "value": "e12739cc8d277c9ceb3b569c89c937fb43923ff29cd50b1d7dcf8ef143131130", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646819245, "uuid": "7124a8a4-2c4d-48af-875d-7167cfd5e796", "comment": "Malware payload (AgentTesla)", "value": "404d7e24be00495d7fc2f5774c4534cc0d1e9935", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646819245, "uuid": "96f4f933-c0cc-4969-81cf-85d44bdd92ca", "comment": "Malware payload (AgentTesla)", "value": "d83bbcd32d90208b0443c74b6772757d2efdc852e12efaa6465c4cba7facd03f1e733e8ee8b12229245ac5c010afa90f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646819245, "uuid": "3c875670-7c56-409c-bb1c-754fecbab0f5", "value": "T1F0358DD339EE420DE3769A713FB8F89E995AEF63151A208730D19F3E44229488D617F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646819245, "uuid": "896257b3-cdc3-412c-b494-06a4419d22af", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646819245, "uuid": "bab356a3-eaf1-4643-93e7-dc8402b2b4f7", "value": "24576:OFD5kkGH8Dr/+wWOcatHddgXICwr+Q8uRPV81MW1:eD5k2KOcIddgYT+DcPnw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646819245, "uuid": "3f9f7771-5fdc-4bb1-a17b-382a36d7bf26", "value": 1153536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646819245, "uuid": "c268e406-3c62-411b-8f52-3fd301af591a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646819245, "uuid": "7d5231de-80a4-460f-9f26-efe39d8207fa", "value": "BANK TRANSFER SLIP.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b0bf2a6-9fb6-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1646836717, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646836717, "uuid": "59c8db00-30a8-47c0-9bc8-60bde8c48ee2", "comment": "Malware payload (AgentTesla)", "value": "2e6a6a39785c1c8ae12a3eb61244b0a0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646836717, "uuid": "97ea9140-1c5c-4174-8c73-c930d4f3e489", "comment": "Malware payload (AgentTesla)", "value": "e18c5ed25c0f53bd5bd138b8b14db574bdce00ef41d32766189ac97422db59b2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646836717, "uuid": "235a4d0b-8686-47b7-af73-54ea32545600", "comment": "Malware payload (AgentTesla)", "value": "f18e6cc182dd4b51e7d455467251add04fe4da07", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646836717, "uuid": "28dcd9f8-f302-4204-a8a6-21f6d56653a6", "comment": "Malware payload (AgentTesla)", "value": "c257fc9cfcf6e8dc0774f7dc54644e84f2755fac9ea41de0f2ae2e371088f0a32284125e33583acc09f27f3dc9e41760", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646836717, "uuid": "c4edc9a9-4e93-454e-99e0-db900eba191d", "value": "T11852189567ACCAF4C8A109FB6CF757521729F752E421CF0F38C5230AAC13B2A45B2B16", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646836717, "uuid": "c158a0d3-4b47-41ac-8235-3aae15e3224c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646836717, "uuid": "d44d6094-8537-4d4b-a8d6-290adfb3be65", "value": "384:7ECn6v2V4ESiTzWjCH62Siiay9ycyrsR2vZErtjj:HnKCOjLycyrsR2vZErtjj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646836717, "uuid": "9429fc6d-70bd-478a-928b-af753e6f1157", "value": 13312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646836717, "uuid": "3c80845a-2746-4a5f-8e56-9b79fd948cdc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646836717, "uuid": "bcfbc88a-0074-41b1-834e-49e156b8340a", "value": "Fvrfhre.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39b79b2f-9fc0-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646840849, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646840849, "uuid": "0f3514c2-72f2-4d31-ab6a-823bdf7462fc", "comment": "Malware payload", "value": "d4fdd80e3f4b1ef0e6c3904d91e5d319", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646840849, "uuid": "f705d4ab-ddbd-4ffc-bb62-615726b4e683", "comment": "Malware payload", "value": "e21670df59190d3739b19dd9e1d55d321c935ffa38796ddcb69dc85dbae3f4ad", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646840849, "uuid": "88b8f38d-5d7d-46fe-8fca-fb5c25d7bbfd", "comment": "Malware payload", "value": "0885db52c203168df3ff2b4f5f3b723a4fb13738", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646840849, "uuid": "b9d62a8d-20cb-4f95-9a79-198350609f83", "comment": "Malware payload", "value": "6dffb8bc579b64cc392d87e9eed905415fb2574baab2f3096976841d7f42647e202a2258535dd945784ab7938bfc8f17", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646840849, "uuid": "d3dc908b-7995-4f4a-950a-847d18f514c4", "value": "T1A0058E6A67A800FDD077C139C9829617E6B2B45A137197DF03A08A763F236E15F3B760", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646840849, "uuid": "f7c8405a-b45b-438f-8e0f-c9b8609f1273", "value": "6438bea8ee8ea1a81b74c061ef29c311", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646840849, "uuid": "c935a44c-9163-4eee-9909-5a7435eac05f", "value": "24576:jLJR/mm7Ky2gWppZbEqj8Uj6gleSnp13T7fbI:5R/mm7Ky2gUpZJImtpFTo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646840849, "uuid": "a5d90589-9d9a-405e-942e-8413793e585e", "value": 852480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646840849, "uuid": "dc3ae2c5-18e6-4827-a742-f32d06268dad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646840849, "uuid": "3653503f-0207-4e92-a301-368d356d4869", "value": "something.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce4d7872-9fd0-11ec-9275-42010a9c0029", "comment": "Malware payload (Quakbot)", "timestamp": 1646847970, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646847970, "uuid": "53d1cad1-abf7-4112-a1b5-625a854edd5a", "comment": "Malware payload (Quakbot)", "value": "882f4fb92f82e01eec04e4cddf9f155c", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama164", "colour": "#6C68A0", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646847970, "uuid": "24679223-6933-4db6-a3a5-e6da4d8e6509", "comment": "Malware payload (Quakbot)", "value": "e21a24d7da7d979264411a7bfffa5775e9701b0487f34045266535d3e8d0d936", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama164", "colour": "#6C68A0", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646847970, "uuid": "995b7504-1a4c-4d3b-9ee6-dc33b77c24c5", "comment": "Malware payload (Quakbot)", "value": "768373dad3346abdf3b19eb048317fa5c29defdc", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama164", "colour": "#6C68A0", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646847970, "uuid": "d4132d1d-aa3b-4610-852a-88e2a75aa5d2", "comment": "Malware payload (Quakbot)", "value": "30575306c04ba73587d6349afcd68886f6b5160a7807811e23817b5df4bf48d4749a0b47a166bfa23c404a4adbd0d7b3", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama164", "colour": "#6C68A0", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646847970, "uuid": "3ea482d5-3d93-4eef-b9d6-a0ec00305490", "value": "T1B2657E23F2C1887AD4761A3C9D1B739998BA79112D28F4C77AD44E8C1F37A433666393", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646847970, "uuid": "5581bbf1-2c40-47fb-bcdf-6f86f01ab571", "value": "cf78a88c4b0403a976a85038ec51a351", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646847970, "uuid": "1db790da-4d96-497e-84fd-53d1ade2ebc6", "value": "24576:LP2GXxd5hyXOZk/R8SoMbEYN54UUrW/tRJfJDOIU2SAHl4XoWSIgX4T:Lu8jI6kcYN9RDiKKgX4T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646847970, "uuid": "e54252d5-c77f-4e29-8c5e-5ac0d4d9dd62", "value": 1502720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646847970, "uuid": "e20d8f1c-2f82-40f1-bdba-146fe6c62255", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646847970, "uuid": "5f205581-71ba-4796-8d75-16cbabe9e61a", "value": "5972373.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa16049c-9fa3-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646828716, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646828716, "uuid": "5f8934c5-06ee-4484-b250-49b0cc988c32", "comment": "Malware payload", "value": "5b1f71c4f9f13b603d36123ed4c052ac", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "iframe", "colour": "#73243F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646828716, "uuid": "dd07716f-fc5c-4bdc-8451-54aca9ca627d", "comment": "Malware payload", "value": "e21f01567dca2d3b7d1f2506422d1a17791d3f25b92d4a1999b8f4fe742ebe17", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "iframe", "colour": "#73243F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646828716, "uuid": "204e99dc-ce2c-4e61-8dd7-5fa122f4459e", "comment": "Malware payload", "value": "a5ff6caa486278417960d24f60a3506f64b53238", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "iframe", "colour": "#73243F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646828716, "uuid": "707d3720-b5de-4ea0-9974-296df19122f3", "comment": "Malware payload", "value": "c409be5afe144a89aa6f5a836881ccd36b77a80b28a57875a040dd19ba5399c166745e3e4ce61321fac6b9bb5ac1bb98", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "iframe", "colour": "#73243F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646828716, "uuid": "fc97ace1-d640-432c-af6e-e149dc8a1100", "value": "T115D18FF1D10AF4636559433D829878E18ED0B35BC3880DDFF056D16A76E6F099E313A8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646828716, "uuid": "224c88e9-df03-4f46-b4e9-fce00a747871", "value": "96:m4ZtLm1R+vJb+i+nOkAlvt0Pf8s1OQ9SW0mpu0QHvdjirY1tO7xi8R51KrbjU60B:m4ZgR+vGOXv6PFOujpu0qUrYXOYrUocz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646828716, "uuid": "2cea659d-1518-46b1-b447-c81b0f513443", "value": 6491, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646828716, "uuid": "4c9c8cce-6b1e-4404-99df-f35ce2df2dae", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646828716, "uuid": "73ebd315-d4fa-4333-a768-513ef686ed0c", "value": "1086005031007.html", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b63ba53-9fc4-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1646842596, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646842596, "uuid": "a24f1953-3857-407c-88bf-4aa2afa8c087", "comment": "Malware payload (Mirai)", "value": "410c426018be22b5d5d788afd7e062b2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646842596, "uuid": "9e9f2db3-14d8-43ec-ba3e-9d5c0474e6e0", "comment": "Malware payload (Mirai)", "value": "e22fed6f381af72ee099a7b0198e94f66a669ea2e3c866fe5a8096d235d5c94d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646842596, "uuid": "c53c4e2b-9b0a-4a55-9761-9ee443796b02", "comment": "Malware payload (Mirai)", "value": "d77d8a3502544157529c6fe3cf590388d06f4a50", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646842596, "uuid": "84f6d434-feb7-4f64-833e-91fbba621c6e", "comment": "Malware payload (Mirai)", "value": "37c7d2ace7682d08855471b0bd7ff05a21947877861ebf0fe0c9bd32e0155fffcae1eab65fd0dceb73bd5f45753d84d0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646842596, "uuid": "f8b2ff0f-205f-45ad-a2c8-32ab2c4c5403", "value": "T103C2C0AFE9187E86C58D1478805522C62E8BB2D5805F5ECDD6328C844FA3C5FB5DF8A8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646842596, "uuid": "7abe317f-c3f6-46b3-93ca-096ae806e941", "value": "768:wMfCuj1RtaD4i026VuRPvCN4jWPXWTN1d:wMfCuj1RgD4i0Nuc2WPuNX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646842596, "uuid": "a6ac3e8d-017f-4fff-9d93-1355335c814a", "value": 27108, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646842596, "uuid": "4c758475-953f-438a-a7ef-7b7783595e69", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646842596, "uuid": "1b4c2181-dd99-4966-86dc-7ae56dd6eb4a", "value": "410c426018be22b5d5d788afd7e062b2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db225157-9f6e-11ec-9275-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1646805901, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646805901, "uuid": "1a7c6871-ea2d-4203-adf6-212f655b7f98", "comment": "Malware payload (SnakeKeylogger)", "value": "1a2425255090a5e85b16f0c191449490", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646805901, "uuid": "216abb8f-2e03-420e-969c-0dece5d5171f", "comment": "Malware payload (SnakeKeylogger)", "value": "e24ec722f6503bc48be364db61202fc62531bc5c518c8df1edbe9329403ebf44", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646805901, "uuid": "ae3227ce-1ea3-4207-bcf7-3208e9c64845", "comment": "Malware payload (SnakeKeylogger)", "value": "185aabf7c3dbc58353807af499cd4e8ec3f003e7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646805901, "uuid": "e5b050e5-da22-4954-a439-d95c1febaa00", "comment": "Malware payload (SnakeKeylogger)", "value": "de375a9ac383ba09e4e7792a0691dc421831d48c50ca9ccb7d2a7033edfde045ec51ee60e3ce0a2412126df18c664b16", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646805901, "uuid": "1c32c795-6d33-43fb-9dcc-fdb1551a7210", "value": "T1F844023025B8261AC8AA1FB4F6D82B802EFC5AD3B4DBF209CB7564D115E39C4774587B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646805901, "uuid": "9570952f-fa3b-4011-b043-f4ae8d91870a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646805901, "uuid": "0229f7a7-dd94-4b21-b321-79478d8a660d", "value": "6144:jiz2DwtEXuFHetIQf+wapBemtaYTNVl3GeHYH:OCMyuBQf/0Begn/YH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646805901, "uuid": "bfbd45d6-b75e-4a11-83a4-1459890463a7", "value": 259072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646805901, "uuid": "f47eb209-bb7e-4017-822c-4a51425aacf8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646805901, "uuid": "fc8618de-bc76-4c42-a3bd-8e90d6db7efd", "value": "bashn mirage.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64f6cd7d-9fbf-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646840492, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646840492, "uuid": "3cfc69dc-c554-4687-a621-498a4960640b", "comment": "Malware payload", "value": "9a1dd642b06111646bdc13cdfe761a65", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646840492, "uuid": "2848c959-7166-40d4-b6c0-a9d88265b27b", "comment": "Malware payload", "value": "e27e21d513ab7ab7002b8cf073ddb9d3b56424c0656ad61de368430c78a3c957", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646840492, "uuid": "96432112-d907-4642-a66b-0e96c03f6593", "comment": "Malware payload", "value": "f718304520155d776482541049465ba52e4523fc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646840492, "uuid": "d8a87b25-cad9-4a93-8d11-72c67f48be2a", "comment": "Malware payload", "value": "3f54aea7f271129ab48e0c403771f3fec780af0629754a79d906da64c7298fed571f8393d6e02f6f056fc62e369e0c41", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646840492, "uuid": "7673754d-a20f-4e15-b819-1fd3846b044f", "value": "T15803E02FD078BDBEC57CA9BC22D95171C9AA348285CF979C47600CE0CE6864AF44D4BB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646840492, "uuid": "7c68277e-0ae5-4859-be43-bc32504b454d", "value": "768:k2F+/JP5JQ7qnT6C8ihvMFIcayKoQz++ntgZ8YkgNLag1jBlWMC:kTRBJQ7quGvMFCzgDkghagBc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646840492, "uuid": "9ca40095-a7fa-4369-98d2-4fad76dbcb3a", "value": 38944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646840492, "uuid": "5b4005b7-1408-42a0-9034-3a3edf0d9547", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646840492, "uuid": "ce8178e4-cf88-49f4-ba1c-ab657b6bbe73", "value": "9a1dd642b06111646bdc13cdfe761a65", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88da6344-9f82-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646814353, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646814353, "uuid": "28db6da4-eb34-4908-906a-92808e3e3bf6", "comment": "Malware payload", "value": "0c9c3e49d1aa85c75bba2eea89514a5f", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646814353, "uuid": "44be668d-2213-47d3-bf12-4f32716caada", "comment": "Malware payload", "value": "e39945c031702f8be626c6cdf172724765932cec6cc0533f39666c1e6fb23dd7", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646814353, "uuid": "3f8ff417-60ed-45c8-b2e0-c433e56356b1", "comment": "Malware payload", "value": "454cc056661c167535d2235f74d5235faecf814d", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646814353, "uuid": "4e8144ff-6761-4fc3-a9e0-28f912805679", "comment": "Malware payload", "value": "609a09956649f4d773ad60cada0dd83a266835afd2a4efa5e43c6d45dcc3cd35c52c97327cc1bc97b53bde4a926104f7", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646814353, "uuid": "d473c277-3e8e-447c-9193-a002c44bcaab", "value": "T10D82D0CA2DC004DFD9BE5E73492A4F853502A9B8B228D23266F18EC269336D42310FD0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646814353, "uuid": "8fe0b421-2bdd-48cd-8c53-bb103d440abd", "value": "384:7BP6WbE50kh4q81cVH7yK7cfGhQ/fccGZRWvENn/Nf:dPdE50pq8OHD7cfrccEWun/Nf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646814353, "uuid": "8381b54b-4e27-45ab-875b-198ee9195f99", "value": 17760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646814353, "uuid": "8619d584-ae49-4589-9bca-37b9f2243857", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646814353, "uuid": "89ece3fa-d7dc-4e5b-9dfe-991ec6e6d565", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c1a8577-9fbc-11ec-9275-42010a9c0029", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1646839162, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646839162, "uuid": "c6e8129c-4538-4358-a34d-90bda1fdf4c7", "comment": "Malware payload (ArkeiStealer)", "value": "01111bf0cfc5855b6ad2b21c06a9f057", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646839162, "uuid": "55f939f4-21d3-4598-8a8a-a1c60d2b60c4", "comment": "Malware payload (ArkeiStealer)", "value": "e4420cb1590d572b0131bd5f04da689caca5d89595676ca8dd6770ec4a55cb83", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646839162, "uuid": "8a55e0a5-293a-4a12-bf15-0d6a63944226", "comment": "Malware payload (ArkeiStealer)", "value": "b3b5bace8ec79c3b61e0c69bee570eae0918c0e9", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646839162, "uuid": "7f54d6d8-7f79-4617-a937-70d1dd64d9f3", "comment": "Malware payload (ArkeiStealer)", "value": "66a8192fa4fc3f0534e835596e1658e113fb587c4671c605f4a5f0d2f7a0e4fe82ea07843226c1dfcfc19414eee266ff", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646839162, "uuid": "b555f7df-c285-4307-9902-47f53ab494e7", "value": "T13944E0D07A41C032F4AB773E8516CF90693ABC20DA708E4737792A6E6F353D15A7E216", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646839162, "uuid": "b6c4d87c-c2dc-4ea7-9d93-dfc3b28516ef", "value": "5a9cc6efcf4c0d9db9af136893d09a81", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646839162, "uuid": "0d026972-96d7-41d3-b517-907c34e9f889", "value": "3072:RyqRTeMMnJiorDQbTqAptGGjdSyVherS8J0skmTs52VggjcGkNIVqIHoyVzP:CP7Qb7bEynerS8J0sVd7ITsqcB9P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646839162, "uuid": "bb0e84b3-7d1f-4d80-8f64-a4e983252887", "value": 278016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646839162, "uuid": "403c6842-d65a-4067-b09d-2229d9c9bfe2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646839162, "uuid": "4929c814-14ab-4718-aa69-6aabebb50137", "value": "01111bf0cfc5855b6ad2b21c06a9f057.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "104016a8-9ff3-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646862684, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646862684, "uuid": "ddb5c9d8-abed-49c1-8f1d-885b68eafb1b", "comment": "Malware payload", "value": "66c85d848aec6f5ae5b675f0eb4d24c0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646862684, "uuid": "803e0073-7f2d-4306-9c3f-ae03988b4c76", "comment": "Malware payload", "value": "e44820205789a96bb8ffb0f7c69081c1d07031741478430c5d0d4e810a5fe80b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646862684, "uuid": "045ae849-78b2-45ec-99a5-444cec7e7a5d", "comment": "Malware payload", "value": "3b05adc9865569f12f581f2b9b039fe3288f2cc5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646862684, "uuid": "fcbd3862-59a3-4965-aecb-80659e04246d", "comment": "Malware payload", "value": "7183b04844fd6287b1231a9e7c1e927a141e3da02e5953e9552a33c436760f27cca4d08c86008a58dbeaaf3d4908bd23", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646862684, "uuid": "b610c44a-1a50-4727-a1c5-f5bb3e2311be", "value": "T10A2623A689BD1D83EE8BB23869162D0B92CA0F7490D5919F576ABC35F3FE453901C1C3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646862684, "uuid": "fee4310c-4023-4bd1-9aab-3af0731ebe34", "value": "7c731c5b9001d2535d059651bc782194", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646862684, "uuid": "144270b9-2d0c-46e1-9997-1c46c0f0ec9c", "value": "98304:OWohxu2faAzXeAUf+02R27+qhQGPKwOqe1hXdcdSw9vUXkCj7paZ6qd5vu:johliEXerG677hdy11fWTvUXRIcAvu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646862684, "uuid": "844f6336-dca6-433c-adff-8d55fae47b88", "value": 4719104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646862684, "uuid": "a3fe1e94-a556-4e89-a6db-c35bb586db68", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646862684, "uuid": "749734a1-1f61-4254-8389-566e4df8e060", "value": "SecuriteInfo.com.Trojan.GenericKDZ.83585.20027.15146", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce8f36ee-9fe3-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1646856131, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646856131, "uuid": "574a375c-2ee9-4a8f-947b-7376d39486df", "comment": "Malware payload (RedLineStealer)", "value": "6db8ba62693a55645d1b0c1dd1748dec", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646856131, "uuid": "29c7d064-a455-4281-9b09-bb73ceb9dab3", "comment": "Malware payload (RedLineStealer)", "value": "e5047be2c61c8880489ee88150a335af3d6b2e2c4b792e78965fcee01b7c4d86", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646856131, "uuid": "7897310f-d5c7-4fa1-b3ee-cec5e60fb018", "comment": "Malware payload (RedLineStealer)", "value": "d0e752073a006a2ec3d7c664fc79f6694a1d104a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646856131, "uuid": "04d43c17-59a0-4202-a171-3e6d3006757c", "comment": "Malware payload (RedLineStealer)", "value": "168d5b88d6dbb9e60d527237860c34950de038e7fcf35d9e67f4ab94f3d3156987c76d1d3477cb7e1f114a279c0bd2d8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646856131, "uuid": "cfa1d0c0-dae6-4b5d-ba2f-9445e0d6f9fb", "value": "T14DB4A53439FB5019F1B3AF75DBD87996DAAEB6633707E85D204103864A03B82DD8163E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646856131, "uuid": "693b62f0-4702-421f-8791-b57258a5754e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646856131, "uuid": "83f5cae8-0d45-4e90-ae92-ad3acc7c6330", "value": "12288:H/g7PcIba6xNMHykChGpt9wLA6HK/jSiikDZACbMO:H4XJrMeGZiEf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646856131, "uuid": "e5503559-9caa-439b-b86c-a08178f0d122", "value": 497152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646856131, "uuid": "46de96cd-430b-447b-b132-175c2d506eca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646856131, "uuid": "8fba200f-3553-47b1-8e5a-67f0b6fb48bb", "value": "6db8ba62693a55645d1b0c1dd1748dec", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9cbb830d-9fc1-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1646841444, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646841444, "uuid": "f3b4a862-26d9-4d85-b2cf-21ad7470fb9c", "comment": "Malware payload (Mirai)", "value": "e8b2ab0e8a93dd3605e9bafc0eaefacf", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646841444, "uuid": "a4b7e32d-1f80-453c-b068-f460ce3f4980", "comment": "Malware payload (Mirai)", "value": "e5c060c146ec2c0e45f390f19c06ffd9038828cb1d1c79b10b4fa2b6e09cb05d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646841444, "uuid": "c76ad239-0d00-40a8-9ce9-acdfbc4eb53e", "comment": "Malware payload (Mirai)", "value": "ab52154c5c46d10f0515ce21853bf783c49f3461", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646841444, "uuid": "6cd36fd1-7c97-4ca2-b6cf-2d9cedd7fd4c", "comment": "Malware payload (Mirai)", "value": "1aeab42042164ead10a4b7c8c058805e95265f8c575ef42944b0793faaacb20eb273e3b94e33d1314b4952c931255b93", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646841444, "uuid": "c58d90d9-f6ec-4bee-9b8f-1001b4a08d0a", "value": "T10D83A41AAF610FF7E86FCC3389E91B45248D641A21993B797D34D428F24B24F49E38B0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646841444, "uuid": "d649a733-24e6-409f-8ac0-6549ea914538", "value": "1536:i6ByCpGym6b0RAXgFBpE1aezgN+h8Emqv:FByCpGy9bhgFBA8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646841444, "uuid": "bbf8c564-fdcc-4847-a8b1-a3d29dcd0cfa", "value": 81164, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646841444, "uuid": "d466f175-f8db-4959-95dc-1f7454dafa3b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646841444, "uuid": "aa57cdd9-acda-4074-a591-52a539a1fc7f", "value": "e8b2ab0e8a93dd3605e9bafc0eaefacf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2b0865b-9fc8-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1646844568, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646844568, "uuid": "da6faca8-8d91-4fba-8a08-f1f8f04dce2b", "comment": "Malware payload (AgentTesla)", "value": "0be62ca499c01171388bea79fbeccc0c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646844568, "uuid": "7c25ecc6-9190-4622-a631-622752a4ef11", "comment": "Malware payload (AgentTesla)", "value": "e5df3cbb339438ea43710c2e82139b098331908ce1550fe1b2b6b5f2e138fa47", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646844568, "uuid": "cc3df565-b7d8-4535-ac4e-007acfa35141", "comment": "Malware payload (AgentTesla)", "value": "991edb6e2e9bea9f724b55f3432fd5c3d0247b4d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646844568, "uuid": "b26c06af-0693-4bbf-84d1-15021d27aa36", "comment": "Malware payload (AgentTesla)", "value": "e043b3027215793374a80b331e820d47e7165691d37cab15b9d73f7a1a1b6ca8c3db920f519e0addfc944e6a56bce886", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646844568, "uuid": "527384d8-f8b9-40ce-a12b-09919efa8ceb", "value": "T193257CE2A9EA401DFF36AB712FD4FC8E955BFE732539208F11453A7245339818922736", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646844568, "uuid": "c86f6f2d-6f75-4357-9e6e-c4a3f75e684e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646844568, "uuid": "17b5bf91-30fa-43d6-b93a-f281fd8b084b", "value": "24576:8D5kgDYUKwUx6tRes6t/NFJBBgnhOjQ3YhvTzKZg4:8D5kiYUKJx8RmBcn083MXO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646844568, "uuid": "7fcc3a2a-7249-4265-b240-a2bc51204119", "value": 1037312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646844568, "uuid": "7ac3164c-585e-4510-ac45-09f58c875644", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646844568, "uuid": "cc27f8f4-c940-4863-b76c-9fbca907e305", "value": "SWIFT BANK TT COPY.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe0454f8-9fc5-11ec-9275-42010a9c0029", "comment": "Malware payload (Quakbot)", "timestamp": 1646843326, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646843326, "uuid": "4b8acd55-031d-43b0-bfd3-651769738d8c", "comment": "Malware payload (Quakbot)", "value": "1708157b1cc9b642c506cef793fa4896", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama164", "colour": "#6C68A0", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646843326, "uuid": "23ed5646-3a5d-4d91-97e5-821ba85b5211", "comment": "Malware payload (Quakbot)", "value": "e69786186b1e04a1ace79b7c69e24caa07143b69e5b1d01c14d63e41a9a8b25d", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama164", "colour": "#6C68A0", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646843326, "uuid": "3f044c47-110a-42fc-b42b-20f33c639628", "comment": "Malware payload (Quakbot)", "value": "335add8f93a78b1aaba3c7de08533e9bae6aac83", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama164", "colour": "#6C68A0", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646843326, "uuid": "97a695e1-7685-4239-b899-941118918584", "comment": "Malware payload (Quakbot)", "value": "91ce07fe2999b6b310d14d8d676c0292422c92aabbe9c075b1411d88e48c8fb3ceac80175dffe49047b38f504bb3ff68", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama164", "colour": "#6C68A0", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646843326, "uuid": "3a73f927-b78b-4c04-893c-9b3a8953bbfd", "value": "T1FD657E23F2C1887AD4761A3C9D1B739998BA79112D28F4C77AD44E8C1F37A433666393", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646843326, "uuid": "3e968d41-4c51-48af-a038-a1afd0f9bef7", "value": "cf78a88c4b0403a976a85038ec51a351", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646843326, "uuid": "b153f0b9-395a-4682-8e5b-c5f8c74e4016", "value": "24576:LP2GXxd5hyXOZk/R8SoMbEYN54UUrW/tRJfJbOIU2SAHl4XoWSIgX4T:Lu8jI6kcYN9RbiKKgX4T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646843326, "uuid": "2add567d-e0b3-4a60-8f25-56a514b7ddc2", "value": 1502720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646843326, "uuid": "d7cbd377-d2d1-469e-874a-6c648fbb98fa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646843326, "uuid": "5c08e341-5899-470d-8117-db4c0a6c9e8f", "value": "8923266.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbe2b2ef-9fb8-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1646837631, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646837631, "uuid": "b5b5a479-8e0a-4dd0-ada3-71b544068f38", "comment": "Malware payload (Formbook)", "value": "1aa66b8223c615963427509c46139e74", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646837631, "uuid": "1a248609-3037-42be-b24a-770849641569", "comment": "Malware payload (Formbook)", "value": "e776a5c6c2ea5615ee32b1f82186579a138d9169877ca6cd3d9d4e9c6246935c", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646837631, "uuid": "1527ce88-d446-40e6-b383-7fbc480d574f", "comment": "Malware payload (Formbook)", "value": "7bad450a1f78043b28b199a4ef8aa861ac98c81a", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646837631, "uuid": "f1eda681-0ee5-4248-ab21-ab2dfd2dc23b", "comment": "Malware payload (Formbook)", "value": "6b3f510baad287f894b806e3e5ca2aa23b46ace6cd57e5853cf3700fa1770d4ba1b524d14e1c45c53be42a8df72cb8d7", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646837631, "uuid": "df4f908e-86c0-4366-8592-2b3432e7ca53", "value": "T1361412B67A849E47CC950F38BFDD41144C78EF41569AC2073A963F5D0E327AD8A04E67", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646837631, "uuid": "43686453-40f4-4ef3-8154-03d5f47d915f", "value": "3072:nGrV7vDnIgP/tO7E7A2Q4q/eup7HqhEyaC8Wg5co0gQDYlX4kwb8iBN/zTU9qF4L:E93Vwb/FHq6dCk2o0gIY11iBN/zmSi1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646837631, "uuid": "49f87d42-e873-456f-b52b-17d2418bc385", "value": 191272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646837631, "uuid": "deb6f264-67c9-4659-b6cc-4291106f1072", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646837631, "uuid": "f334676d-c0ed-41ec-80f5-5d29458caf46", "value": "Payment Advice USD 85,000.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64ee387b-9fe5-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646856813, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646856813, "uuid": "cdf35f82-5130-4bad-90b3-9fafec7dc18c", "comment": "Malware payload", "value": "a05c01dd3065d8806b0448cebb20a79e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646856813, "uuid": "7c8c0a74-0fe7-46bd-ad31-66b7eff0e31a", "comment": "Malware payload", "value": "e805be73bd88cd67b7ca27b4beac341a83728eb219722253bcb1876c7acd1360", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646856813, "uuid": "1d738515-b407-4a06-9cae-2813b4073c29", "comment": "Malware payload", "value": "e0e22e55a0a0cf920555c9ef2a678b463e7f6b09", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646856813, "uuid": "b7e10136-db86-460e-bd80-cc219fb45c52", "comment": "Malware payload", "value": "24ebd638edba7127220c2284ae3960eee062ed20bf7c3e207ca09fe4bc8a3907f051039eb8d7182578c6d150c80ef5a0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646856813, "uuid": "9fa9f08f-105e-448b-9a96-296b2d6953a9", "value": "T12983AEE0F18D50BCE6D6D1310AFC93EE1BF7B89AE54390474F726E46A8D23421A1166F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646856813, "uuid": "71b113fe-aa75-4183-be07-23eac81cf691", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646856813, "uuid": "3c472936-b309-4369-bfe3-d31fb7616ed9", "value": "1536:349EhCg13jCOUdAJFikYpWeUVnQ1yM2sv9U33+86sF:349EhdT1JYpW6yPNj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646856813, "uuid": "9795a646-549c-45f3-b9c2-abd5869360cf", "value": 87040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646856813, "uuid": "b956e968-018e-4f61-b47b-f17cc76b2b7a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646856813, "uuid": "8d6ef1e1-36b9-41f5-a739-3d4386683671", "value": "a05c01dd3065d8806b0448cebb20a79e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d370f2c-9f87-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1646816373, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646816373, "uuid": "9fbcda1b-b12d-4888-afed-8c3e1a36af71", "comment": "Malware payload (AgentTesla)", "value": "d3501df828771988f391a701f6f98977", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646816373, "uuid": "1cb86914-d8e4-499f-9276-5a47dca343c0", "comment": "Malware payload (AgentTesla)", "value": "e82480ffcdd760491263ac317ea14a26a35e713007f67f45004cccf0a13fdbd1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646816373, "uuid": "e209ab34-6a66-4082-8051-bb56f15b8222", "comment": "Malware payload (AgentTesla)", "value": "52d05b61c89ea4a1d84cb06f1e3e37a3b0445c72", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646816373, "uuid": "83d4c01c-c3b8-4fab-a93b-3dc10f3316e9", "comment": "Malware payload (AgentTesla)", "value": "e183699c6aab76b7314f74b120f42cd02c07fec65988c030aae4a0413f2a242cc6cd0d28019bc10341f29489e6389570", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646816373, "uuid": "9a26755b-ad01-4af2-a2c1-89ff767bce30", "value": "T1A535AEE629EF401EF337ABB16FC8F8CE986AFA73151A20DB11511B768423980DD61735", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646816373, "uuid": "5ed43034-5f7e-4edf-ab0a-650547eae527", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646816373, "uuid": "02ccf42e-6a35-4ba3-8639-82caf2fc52c3", "value": "24576:DD5k+AkV4YlVDgyfodHtoL257sCtnUNGVJATRV700GMpcD8:DD5kxulV88t25sCtUN6iTM0GMcD8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646816373, "uuid": "4d5f7811-e088-492a-bd15-ec06d8d7ce1a", "value": 1095168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646816373, "uuid": "ac364774-cf6b-470c-b367-1bf7e72443b5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646816373, "uuid": "4f9564ea-cdfb-4bc4-9650-42b755a028d8", "value": "pko_trans_details_20220309_084736421.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f09b67c-9fd1-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1646848186, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646848186, "uuid": "fb3cd30b-155d-4daf-9e32-fbcebe22d912", "comment": "Malware payload (Mirai)", "value": "0e8325166291ba5d2895d21b96eaaaac", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646848186, "uuid": "a7ce7666-1088-4792-886b-309bb80fd50d", "comment": "Malware payload (Mirai)", "value": "e8798f02adabed253ce0d7e3425224153653d10c8ad8bc7bd58c191f07203ae9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646848186, "uuid": "0d745fde-bf88-4ae3-b2bd-28482bb9793c", "comment": "Malware payload (Mirai)", "value": "5c5ce8e3bd60c11347dd2ccf04728b69177caf8e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646848186, "uuid": "507f076a-f552-492e-b4a4-911b34ed777b", "comment": "Malware payload (Mirai)", "value": "fa8d99cc0278bb4e9b2fca21382671a02e4c323245dc1a64139938a3cf08bd639e7fd5f388f726d7578cb9673c8d3787", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646848186, "uuid": "a2c79e77-6047-4c3c-9cda-0d1b4157229a", "value": "T135732ADAB800DEBCF40ADAB68557490BF531A3518E930F36662BFD837D720A44D27D86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646848186, "uuid": "f7dae7bc-a928-469e-9eba-5ce13472770e", "value": "1536:awW0PKt9cwxjQ/1IXIdZzN3DD8Utia84GLf84Eo5WOK+7c4R6yN:awsgbdZzNHFtijjESWBryN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646848186, "uuid": "6a709efb-0679-4a53-b6bb-1e4b7e4a06ce", "value": 73524, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646848186, "uuid": "4f6eaa80-bd0c-4d47-ab19-5bcaedc460df", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646848186, "uuid": "5bb2c57b-e4de-41f7-9f8f-2d77e530213b", "value": "0e8325166291ba5d2895d21b96eaaaac", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91257079-9f8b-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1646818232, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646818232, "uuid": "5543c748-8d84-4d78-91c8-e9dd7c61a501", "comment": "Malware payload (AgentTesla)", "value": "3902e704229d5c589f098bda66e71b68", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646818232, "uuid": "97f3f73e-e2e9-47d1-a918-e2ae2fd0696e", "comment": "Malware payload (AgentTesla)", "value": "e8d4e10769505d71c18eab7a9828c4988e1e7526c8a026da951197230014b4f4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646818232, "uuid": "a65aa284-5895-4f4b-8fde-b412eb684a81", "comment": "Malware payload (AgentTesla)", "value": "08525e6bebb9c6535615ae3ebb335ea2a664e37b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646818232, "uuid": "8bd79822-8f7a-4ba0-bfb9-66e6ce3f2747", "comment": "Malware payload (AgentTesla)", "value": "43d7271b1396c6a32f02b715f262b8f89639c311296dde5d678ad2f16f2833e639eabff4ebed1d0329c97f3adef6eca4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646818232, "uuid": "3d2701ef-9d2c-4ab9-acdb-93f5940ac63a", "value": "T189B423B05F38E57ECB52A971DA3834A9E79538EB64C5C37803332F099BB19A531E910D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646818232, "uuid": "9dec382f-9d65-4667-8d10-c9feaa55d7ea", "value": "12288:xy4PFe59wQWAwinsJg9qbpmLkhmRjkA+c6JY4EX:fPk5+Q3NsJg9qdAkhmOGWEX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646818232, "uuid": "051c12da-7323-4413-8b6c-60f9466cfd6e", "value": 499865, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646818232, "uuid": "89e8921f-ab01-4374-9fd2-1a47a34814e1", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646818232, "uuid": "df85a860-de69-4506-8729-709bd6370564", "value": "CUSTOM DECLARATION.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7eb377c-9f89-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1646817465, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646817465, "uuid": "29861057-8862-43ac-9c49-49024f1a9771", "comment": "Malware payload (Formbook)", "value": "90112a3f154b07a82e5ea523e7631f20", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646817465, "uuid": "8bf15b17-8590-4153-afa4-5db15232d622", "comment": "Malware payload (Formbook)", "value": "e98706b7597c00c854c61d51a05413681020c6096024aee23e924b6eeaee2a5d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646817465, "uuid": "154e2e56-6441-46ad-bf32-c2c31e7f13a4", "comment": "Malware payload (Formbook)", "value": "e2d32fef75f06b1301c80e7767177d4597696edb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646817465, "uuid": "2cfec8da-19d9-4881-b22c-9a80dc9b0c39", "comment": "Malware payload (Formbook)", "value": "b98adb942ed796f87bd023ce9f03afb53f4f474bb64d54db8d998073c42ac0b7117cc5dee5fd83f1d30c2db49f7f0b49", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646817465, "uuid": "8f1d3a12-74e5-4f60-ba9d-5c4123a03320", "value": "T1F574132C72C244B3DA6B4AB51BF0FBFFAB75D2885FE1D9479BA45E722267040CA43051", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646817465, "uuid": "1b7916e8-5648-45b7-a0a7-0613db9002b0", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646817465, "uuid": "75f3b625-aa68-49c7-8757-269462a2deef", "value": "6144:rGim1L0TWlfabWqXmzw8DSIaN6IPKjCmYq8/P3ln5NaQM+ewkMsjGSt9Eu:7T+iWqmzLSIG6IPaYq+PV9vOqG95", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646817465, "uuid": "63f0250f-a36f-41ce-b1e9-1de60f4c1111", "value": 343961, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646817465, "uuid": "f51a875c-c1b2-494b-a47b-d668f86768ec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646817465, "uuid": "07fef5c6-245e-4192-9ab1-8c70af232395", "value": "vbc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18d9166b-9fcf-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646847236, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646847236, "uuid": "37abfbbb-83f1-4932-be6b-5717449f3775", "comment": "Malware payload (Heodo)", "value": "a1c6b18312f45b1a7e499b6b0e522f04", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646847236, "uuid": "23f3cbc7-0a4a-40de-932d-fd1432cd1221", "comment": "Malware payload (Heodo)", "value": "e98dd238be30029fbaf43ca1e87760a3181ac1c9f2a543d7e3acd08adedabe97", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646847236, "uuid": "aad6a59d-b456-4293-ad8a-9d7e1fd611e1", "comment": "Malware payload (Heodo)", "value": "ec4fb1146c8220089c65d2b504151dac4ad92d14", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646847236, "uuid": "6540860d-96bb-4265-8e49-c70fdf82bcf4", "comment": "Malware payload (Heodo)", "value": "a525980d584cecb40203625983292fb1d8b10a9bb131eea4f6f24830f8663421305de2868244683f539b4228ff64ef1c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646847236, "uuid": "e16bbaa3-9792-438f-8cbd-4a534f398b8f", "value": "T1C3257C107E8A817EC71B85B30836676D6FFEAB204B6CA1CB478175ED2D316C29B36705", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646847236, "uuid": "27cae42f-d473-4028-afa9-a437f1005e27", "value": "087c9809507dfca4c3283e6c7539e91c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646847236, "uuid": "ac00719e-5875-4649-9140-bb61e0a44b57", "value": "12288:cR5SOyRHiA6m0OcEl9zt6JtcS1j2xKkr:cR5SOrKl9zEtcK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646847236, "uuid": "ddc14e67-5596-4a83-849c-cacd71f87fd4", "value": 1040384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646847236, "uuid": "cc5fa090-c7dd-4294-8eb1-c3acce78cd90", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646847236, "uuid": "faf1cd4d-afbd-44cf-89e9-74475019b1b9", "value": "a1c6b18312f45b1a7e499b6b0e522f04", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d4a0dd2-9fbc-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1646839271, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646839271, "uuid": "ffb06179-51cf-4f66-a8eb-bcdfdcea685e", "comment": "Malware payload (AgentTesla)", "value": "dfe041d2d5cdcd6f0ec2b649907bc9ce", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646839271, "uuid": "2cd97ff9-9359-407d-8f31-288744e3068f", "comment": "Malware payload (AgentTesla)", "value": "e9934ba15dc0f7b48e296f7047693fc8b1dba8ede2e81bf2a8295406d7bfbe85", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646839271, "uuid": "a9eac1fd-d16d-43d0-aa96-f6fbd83243d0", "comment": "Malware payload (AgentTesla)", "value": "4033feabe8207a3a48dc6c6d054ae2ca26b570d7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646839271, "uuid": "5f569d72-f4a9-4521-a228-d6ba8cd874a0", "comment": "Malware payload (AgentTesla)", "value": "cb7f95d77c46fa626dc9eca559ed2bd77e6714ea1aae6f6df27bc557ce1137e7ff46d62274aef94485a0556134da4dc8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646839271, "uuid": "d9b09229-8f20-4dd3-b400-904403060f12", "value": "T1D525DF10EA66113BF26E9E792BC5F96349EBB1B61604E1BE1C2CC6860FE153DDD81C31", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646839271, "uuid": "e3a5b613-61a5-4dce-8c8e-83af4a2b8520", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646839271, "uuid": "3a7f186b-8cef-481b-a6da-a6b85ba7b192", "value": "24576:Efpd9WddvSYxNfE9ucFN+4C+6F3aBHtlX79pghRK16tDhwJUVVLTzurUvMXU:Efpd9WddvSYxpYQ+QGPpB1QDhwJUX4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646839271, "uuid": "5de23b97-2ce8-4424-82f3-0d5e7fb0b0d9", "value": 1054208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646839271, "uuid": "0d42d486-3b4a-4944-ab77-4a2306f715b9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646839271, "uuid": "125f2664-ebb4-457a-b9db-6bc9cbce2439", "value": "dfe041d2d5cdcd6f0ec2b649907bc9ce.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5645e223-9f8f-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1646819851, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646819851, "uuid": "48a3db5d-d1fc-4535-8990-a8a2ffd26934", "comment": "Malware payload (Formbook)", "value": "234b9e91a59dc06d0219345823543853", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646819851, "uuid": "58b1e46c-ede3-47e2-b1f1-a7edaaaeed2b", "comment": "Malware payload (Formbook)", "value": "ea5a2cf2a4c8ddc7f01d6b8a573efa20b7dd35fe633e0d1413b0d41e2cd31874", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646819851, "uuid": "2dbc5e91-a528-4511-931f-99497cf7fa9d", "comment": "Malware payload (Formbook)", "value": "add946e56fd8ba6ef7bd40d888f251bad11d4507", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646819851, "uuid": "d893d2d7-3b65-4dd6-a1a8-00e7269ee88a", "comment": "Malware payload (Formbook)", "value": "1026394d5216fec12d6d686b7d1977010fa2dc6389e17c4a75d8b96b58407770dc7cadb71d550d5147c38ecb00083623", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646819851, "uuid": "be7f6bf4-7ef1-4d10-b9b6-4921eb1d3d49", "value": "T16A058DEEB7A24437D0232A748D5783B4A429FD102F2054476AECBF0E7F355967A3A163", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646819851, "uuid": "fc81bff0-c086-46b6-ba7c-afdbcf192aee", "value": "9a2305e23c811e08425371fd3caa41ef", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646819851, "uuid": "5a924462-1acd-46f5-82ce-c1821aa8eed7", "value": "12288:cPsyMBzW+hNm5/WWZfeApLrY6xVct+LeIzl/ORIlRfk:qsxl05/WQeApwkVykhV7f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646819851, "uuid": "5c3aec17-ceb2-410f-b417-f575e39dcc91", "value": 837120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646819851, "uuid": "57eed72b-ab01-439e-988e-2751207010d3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646819851, "uuid": "1ee033d2-bdf0-40c4-9fa3-e580e4fa6b95", "value": "SOA_OUTSTANDING DUE #FEB & JAN Updated LIST.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d1c7e45-9f9f-11ec-9275-42010a9c0029", "comment": "Malware payload (Arechclient2)", "timestamp": 1646826762, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646826762, "uuid": "89439fd5-7fce-4a99-9a27-24cb07562a64", "comment": "Malware payload (Arechclient2)", "value": "45fbceda9bf07f265d779a8f88113bf1", "object_relation": "md5", "Tag": [ { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646826762, "uuid": "1f4048d2-c82f-4328-814d-d26bf47645ba", "comment": "Malware payload (Arechclient2)", "value": "ea7e4e307e47c6fc4a115de164fc75258e7051ec14dda264563cde054e31610a", "object_relation": "sha256", "Tag": [ { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646826762, "uuid": "6f1f843e-268f-4ee6-82da-f248d1f16f6b", "comment": "Malware payload (Arechclient2)", "value": "f858deeee0503ea7b0ccd0322d7286c19909e483", "object_relation": "sha1", "Tag": [ { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646826762, "uuid": "6f166848-55b7-4ec3-8c9c-bd36ef57a33e", "comment": "Malware payload (Arechclient2)", "value": "0c40d9921409bdf33887f9a1aa41bb91d4ffe01472ff1bb61fc50cf587f8e30f4ac93ae32c960880268c589f1f69b5ab", "object_relation": "sha3-384", "Tag": [ { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646826762, "uuid": "2813dcfd-5e89-4753-8501-40f7d3c4f57c", "value": "T18693E9F09FF8B965E1182077B8A0B13C37D75D4EDC51953AEA4BF14A38629C221E5E0B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646826762, "uuid": "4d739248-0649-4551-953d-59e447f66789", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646826762, "uuid": "ad003f21-93f9-4166-971a-aedadffad38f", "value": "768:Y0y5eKwRoZXI73mHZ9IBg815W1S7CblMxWQ+mvp0cxYiSyvm9Xhw:YDeKwRwIGZ9Ig5S7CbGxIm3x7Syh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646826762, "uuid": "8575e47f-15b9-437b-9985-d2df45c655f7", "value": 91536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646826762, "uuid": "8d411289-b436-44fb-8118-275d4f160441", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646826762, "uuid": "c88969e9-d4ad-4dcd-9938-ffa53201200b", "value": "ConsoleApp_cert1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0eb32003-9fbc-11ec-9275-42010a9c0029", "comment": "Malware payload (Blackmoon)", "timestamp": 1646839059, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646839059, "uuid": "dc4e0016-ae99-499d-948f-f61668506e9e", "comment": "Malware payload (Blackmoon)", "value": "baf481ef2e6897d7ac462dbab1a0c5f7", "object_relation": "md5", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646839059, "uuid": "0664ae31-099f-496e-a184-f4286640f0e1", "comment": "Malware payload (Blackmoon)", "value": "ebe588c49f9735f4efbed599b492410703a4a49ec347c6c54e0d0d8a6532dc83", "object_relation": "sha256", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646839059, "uuid": "0a5fef70-3956-4250-9642-a69f8c5e65b1", "comment": "Malware payload (Blackmoon)", "value": "39e2eb47062fa01ff57b93340040f5168a9f94c9", "object_relation": "sha1", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646839059, "uuid": "bf55dfc1-3dd3-4aac-b1e2-038c8dc8954c", "comment": "Malware payload (Blackmoon)", "value": "fe70c14194e826bfa78840900b5b5e8ace54bda29cf9f8af31f66cf5e6d0d1f7bf6f37579595bb552a7acb96df067dba", "object_relation": "sha3-384", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646839059, "uuid": "8d78baf5-2d36-4699-8c39-67e5cfcb4382", "value": "T1E245239A841325A8F4D02DB215BED9C1534EB5133A843E212D57C9CEB534EE6EBD3E0D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646839059, "uuid": "e221af60-1b7c-448a-b4c6-600fe937c93b", "value": "acc384cfc66d33262df1bf4ba30ff02d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646839059, "uuid": "df6cfa65-456b-4ae8-b10d-5f67f37347f2", "value": "24576:eB0NWp6nr52LyDXRfJ5dwEztbXCmAUscM7P8g6A7Vpg83atTUHnlr:eBSDnV3XRfJ/emAUscMoCVuw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646839059, "uuid": "f7df9882-3096-4ed0-930e-95a438ef402c", "value": 1238016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646839059, "uuid": "efd35d64-a716-4ff2-9f57-68fa307b81df", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646839059, "uuid": "4701db52-0828-4858-8770-59c34c2179e6", "value": "baf481ef2e6897d7ac462dbab1a0c5f7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b0c3352-9fe9-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646858434, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646858434, "uuid": "606ce303-d3a6-4439-b1f6-61979e65939b", "comment": "Malware payload", "value": "3a8d94e7ee36a9809d139a65d86d3460", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646858434, "uuid": "4ef8891b-595a-4b17-b8c3-140daaf36d89", "comment": "Malware payload", "value": "ebf5dad97737e37f62123cba90cd2f9597aaba3cae6412a12d7209a509e05258", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646858434, "uuid": "ac1d2b79-e4b3-4141-8eeb-fcf19496847e", "comment": "Malware payload", "value": "543924c8423cd5b85a99474913965bf50e53f64a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646858434, "uuid": "31565ce4-2d6b-4ac5-bc8c-16b17ee929c6", "comment": "Malware payload", "value": "b545648c0c514233778a5914349e34484dffc37e2ab2549f2e6cc1d8af4547b319b64414b956fa34d439c004d66dfcbc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646858434, "uuid": "103a798b-67da-49a1-b457-36df3f26afea", "value": "T16E82B52633948599E5D089348CC79DB009F4BD33A441B7AF7BD03E6EAF33A81E6452A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646858434, "uuid": "638d6fee-94de-490b-a426-a2ea20d2a74d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646858434, "uuid": "f0627465-fd5f-4aa5-8777-2bbc88aec8f0", "value": "384:hwteGKAA7Gy16ZUJK0KDQckRKDVbJapdKDGPGAs:hwoGv+JO90PGZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646858434, "uuid": "3de739de-709f-4904-87e0-1a19578715dd", "value": 18944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646858434, "uuid": "4160c66b-0adb-4d7e-9c8f-fe1eb6bfe2ae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646858434, "uuid": "3786cd68-8286-4336-803a-fc6553491346", "value": "3a8d94e7ee36a9809d139a65d86d3460", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6bb8ad7d-9fb6-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1646836638, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646836638, "uuid": "367fcb1c-40ec-4624-9fa5-79136bdf428d", "comment": "Malware payload (AgentTesla)", "value": "7447308a772872df77d4ee7257207b9c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646836638, "uuid": "93c23d45-f00b-44bd-a347-5f65a77d9501", "comment": "Malware payload (AgentTesla)", "value": "ed0d4754b706891c39af5e3672630309389ffb9465407d5ce732bafd3ba60c4b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646836638, "uuid": "e1bcee32-f1bd-43d8-a501-042464e12fdc", "comment": "Malware payload (AgentTesla)", "value": "9a0c0528a567404d958335877963b8ec098ce0b7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646836638, "uuid": "353301cb-3b89-4e36-a2a1-740710ae7e8b", "comment": "Malware payload (AgentTesla)", "value": "ddf5bc8296af624fe0ec23f211e010eefd02f12075dacb86788c7790b64d50c3cd920a5f92bee73bc41a3a78da2a3c27", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646836638, "uuid": "46726199-819d-40d2-aa55-148217f479cc", "value": "T1C97568F0AD11D4C1F57E5F6AF2FD3A48A1343217EBCD4A4A00A4A6552EF6A11F90ECC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646836638, "uuid": "44b66934-3e50-4b87-a7b7-3b3b23c77949", "value": "24576:Sk50AWHLUxo2G2Kioa8MCVZKbSkVnCxU/in:o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646836638, "uuid": "f6d6d5c6-71c2-43db-9d4c-381ff9e1cd23", "value": 1698930, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646836638, "uuid": "914b7e52-2ffe-485a-986b-2d7a668c73a6", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646836638, "uuid": "140fde59-aaee-48fe-8b14-43614c7a309b", "value": "RFQ COA 193283.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ce9b18d-9fed-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646860235, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646860235, "uuid": "1fb1c482-19e3-4ec2-9511-9a9e80bdc8b9", "comment": "Malware payload (Heodo)", "value": "a6d42c1c52f36040a264933cb89d4912", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646860235, "uuid": "590624dd-e671-4c24-94be-d816056f835c", "comment": "Malware payload (Heodo)", "value": "edb1f62d16d8de4325387131b3e28542af74f46ed61def4c27728cf410ffa373", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646860235, "uuid": "0e6f52a1-8401-4949-beb8-bcff08ad6604", "comment": "Malware payload (Heodo)", "value": "7cf29dffd12fc95bad4f243419f81604c000a494", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646860235, "uuid": "063f5bb8-f6fd-468b-89fe-2f7a365d2d84", "comment": "Malware payload (Heodo)", "value": "675876b060663adb9d8f450ea779f858445651ccf270cf32b3c3d02a6f31ebc2239502dc91121fb15316f23ee3098169", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646860235, "uuid": "8e09a70d-b420-4676-b0fa-080ee6d73314", "value": "T10BD47B0023729872C3FF53760EE592F05AEE6DA1873101F735B872AD4A779D1A73492A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646860235, "uuid": "19ef5bfa-fd6e-42ce-a012-1af827a2cc9f", "value": "bb2e319682f72745317e92a26483f973", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646860235, "uuid": "bc20c469-7a9d-4c51-ae0c-8a2506966dca", "value": "12288:mc5R6LLnljSDIGRIyAAPIqjYtRLfCjzhmD/bwb1r8Hc:Bg4IqjYTf20D/bwb1wH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646860235, "uuid": "24a3b49a-38de-4ff8-a7bb-517d2d4ccbce", "value": 630272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646860235, "uuid": "d418cd96-1d69-4030-88f3-b5396ff2ca83", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646860235, "uuid": "9157de75-4521-466c-b746-5e65bb5ff12a", "value": "RoundSliderCtrlDemo.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57a2e1e6-9fa9-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1646831021, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646831021, "uuid": "3222e797-29b5-4ce7-ab93-3760c0ce7aeb", "comment": "Malware payload (AgentTesla)", "value": "59fe72af26e87503ea54644ad5cc9ea9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646831021, "uuid": "8863366c-8c88-41aa-988f-9b22cdcee472", "comment": "Malware payload (AgentTesla)", "value": "ee3d8ed386059a7c9b49052f0c098a926ec67bed9ae4ddb6570133be16ae9750", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646831021, "uuid": "20e1d745-c6ce-47e5-ad91-321767b0b0dc", "comment": "Malware payload (AgentTesla)", "value": "106f378a575b742056d9bc27d3b50814cdf1e812", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646831021, "uuid": "ab8848ab-1be2-4beb-b0af-14ff8f949c83", "comment": "Malware payload (AgentTesla)", "value": "73df00e67b38621fdb018e00a493d076480786934d010aab98d34b0354ec915c0bce7f5e0ce834d61d2133369969df9b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646831021, "uuid": "569c446e-8a9f-43fc-9625-035600a63ebf", "value": "T13725AEE629EB405DF337ABB12FC4F8CE956AFA33151A30DB14522B768423A50DE21735", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646831021, "uuid": "fffcf2b4-e395-4745-a86f-8ce48768f1a3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646831021, "uuid": "c8d77b4e-9246-45b6-83ee-28abdf97a460", "value": "24576:GD5k/ggtAq1Av5rO14Knq/E1bh4jU/KI:GD5kxAqivZKq/+bh4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646831021, "uuid": "cbb9c3b4-ff83-41d4-9e49-eb5ec7e33b8a", "value": 1009152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646831021, "uuid": "16438617-cf5b-41cb-9c11-a03032e8e08f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646831021, "uuid": "dbb3f7a9-bd11-49fd-bcbb-025368e07b20", "value": "Shipping Document.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2eaa448-9fb7-11ec-9275-42010a9c0029", "comment": "Malware payload (OskiStealer)", "timestamp": 1646837160, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646837160, "uuid": "becf53f3-3dd2-4c16-919e-902fe4bcd72d", "comment": "Malware payload (OskiStealer)", "value": "62300a03fe25094edeb42eb7fcc838b2", "object_relation": "md5", "Tag": [ { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646837160, "uuid": "19b740eb-2135-4af2-8345-e5e852accdcd", "comment": "Malware payload (OskiStealer)", "value": "ef29369de16b4ba38dffe86191c1c9abb1050b0bd0a999e5e0650dc607c7fc90", "object_relation": "sha256", "Tag": [ { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646837160, "uuid": "7f9a1c19-8caf-4ed1-8284-c00b41918bb9", "comment": "Malware payload (OskiStealer)", "value": "e39628d7750ec47a6e16aa2433af55fcfdff8d1e", "object_relation": "sha1", "Tag": [ { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646837160, "uuid": "f52c12eb-288e-43b9-bb1a-176205bfb386", "comment": "Malware payload (OskiStealer)", "value": "f9119048d212232e0782ffdc6f1fd35f1a481957b0b8c0c9f8e5b6a9f80097d1602817b86a4bb235d64906f24c8fd3ec", "object_relation": "sha3-384", "Tag": [ { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646837160, "uuid": "18e0ef77-a1ab-4231-93dc-ed9ac1879ec0", "value": "T17C14022C71D0A510DC80037D2F6BE6967546CF07192A392EA07DBD6C427BED46A98A2F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646837160, "uuid": "085a143a-c3e4-4ae0-b4b1-c310c7dc4774", "value": "3072:uKiLRfpMFl19iVz0fXfFVGBOhnT6ZrWHOIkA1utHB6DO6EwT6LvVVF8WaZN2nC4D:NUhMFTuof6MT6xWuIkuuJoCHk6LR8129", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646837160, "uuid": "fc25df23-3d60-40d5-b336-308348c812cd", "value": 191288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646837160, "uuid": "ac5e99e2-3c06-4abf-b774-d590edddbdaa", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646837160, "uuid": "b16adb6d-6f4a-4bea-8361-62a72525fbe5", "value": "BN63200IN437668.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3722a9bd-9fbf-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1646840415, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646840415, "uuid": "f02e53b1-7563-4758-b7ec-b1271620ef3e", "comment": "Malware payload (Mirai)", "value": "bda68c2ab1af3c89bb2e35fb02355444", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646840415, "uuid": "30ee3b7d-489e-4bdd-af05-9ccec6615b7c", "comment": "Malware payload (Mirai)", "value": "ef5d37a61aefb68ad7d19eee38d8c6f515f613d6dd87b73334f076883e7a77f0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646840415, "uuid": "e4c5419d-ecf3-4c7f-8f1f-219580a9b883", "comment": "Malware payload (Mirai)", "value": "35724d61f2d5a4d475a7bb1ee100824867d4a00b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646840415, "uuid": "3e5a57c2-a115-48d5-b953-eaedc6d900de", "comment": "Malware payload (Mirai)", "value": "9b37bc66b632d20425a5107055e00f17a81183ab32f968cca840b52985338102435453ecfd1a435c37ac9a49e180bc68", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646840415, "uuid": "5d39cdbd-8f56-4f68-b125-a792959d1264", "value": "T13E331981BCC29902CAD42376FA2E01CD332663A9E1DF72179D216F5137DA82F0D7B652", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646840415, "uuid": "82dc4fbb-bfc9-4d23-9dd4-c0035fcf7100", "value": "768:xnoGCh6mppCK2FdThNutUGUiT5lBCC/L0wIefWBJNois01fBNwoxBA1sP9AwE:9oGaTDC7F4Uitl0K0wIefAJRrxea", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646840415, "uuid": "2208f1da-ffbb-403e-b92a-f76501b5c211", "value": 54088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646840415, "uuid": "e44f9d5b-ce2d-45c8-9bf3-87e66a62290a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646840415, "uuid": "ec4a75db-9e44-4a4e-b62f-e711f59bffbf", "value": "bda68c2ab1af3c89bb2e35fb02355444", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38f87dcc-9fb8-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646837412, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646837412, "uuid": "8b7dba58-1729-4395-8dbd-9214b4679f09", "comment": "Malware payload", "value": "b5a51d6ac3624bfe1f2d028c4210534d", "object_relation": "md5", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646837412, "uuid": "fc19f370-7ff7-4474-a3b8-f355d4e2d449", "comment": "Malware payload", "value": "ef653eb925a84e21826e454540e5d9c719ff62f87a323823ac299afa0c03bde6", "object_relation": "sha256", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646837412, "uuid": "9862ff2d-d24f-474f-8fc0-bbc87e430bb6", "comment": "Malware payload", "value": "efd35a01da6d22fac3f1198870ae9983e53d7fa0", "object_relation": "sha1", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646837412, "uuid": "fc0d68e8-2610-4eb9-b004-d0289b3ffe08", "comment": "Malware payload", "value": "54fdbc97f527feee6e716cfe20382fc7ea3aa6216ff97b9b84dededd1f8b94a846071ca8aa9b21b7cea65cf0d44541df", "object_relation": "sha3-384", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646837412, "uuid": "956a0c44-55f4-42b1-aab6-ae9ab9e1ca60", "value": "T120141221FF96C26BE618273D4486BAD1F8BA6CE4CA8F1307BC53324186FCA495657907", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646837412, "uuid": "ee0219f6-ab79-4e9a-ab49-76650e7e3c20", "value": "3072:yUfyDTA1VnTvVZoSW7DNIlcmFYdy7fO1qqG6V5qoN9/i7HtpGWSMFt5DKqeTNTVp:B5VnDm/6ymGy7O1q3RU9/4NU3MFt5DKF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646837412, "uuid": "152c9356-8af9-479f-b04d-612d152ca32e", "value": 190920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646837412, "uuid": "c9112831-430d-40c7-a194-65813bb8308d", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646837412, "uuid": "f98890e7-c603-4289-aacb-38b6e40bae99", "value": "PO 4526565101.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f9ef95c-9fbc-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1646839221, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646839221, "uuid": "c4f4b49e-ea63-4e4d-b1ef-c3afd531ce86", "comment": "Malware payload (Formbook)", "value": "c1e31db9bb0c6763f480482d5c70e1d6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646839221, "uuid": "21e3e5fe-7305-48f8-b97d-e6b1acc310db", "comment": "Malware payload (Formbook)", "value": "ef808aede6f70068b433647ba15f37e8b2b207b3bf1bd2e8d623ca0b18a64f5f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646839221, "uuid": "7e85c9a4-2c07-4665-ae16-16d57223bb10", "comment": "Malware payload (Formbook)", "value": "8085f114bcbaa687e5f61bd7f07057d0dd5bc6d5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646839221, "uuid": "57cf98d0-ec49-4b96-943f-14cede17e5e1", "comment": "Malware payload (Formbook)", "value": "5b6bd342399d5d81456c755d00bce9d705fd6875893e99b91ef86b156c394609cf14d79fad9c4601f75746a95fc501fb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646839221, "uuid": "61455551-07e9-49b4-9b39-8decfac7a492", "value": "T122059EEEB7E14437D0732A785C1793B4A828FD102F2414476AE9FE0E7E755A13A352A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646839221, "uuid": "c3b6b11a-2b6e-46cc-9ec0-8090c2596fba", "value": "9a2305e23c811e08425371fd3caa41ef", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646839221, "uuid": "87ccefd5-02a2-4aff-8865-416e0f89df45", "value": "12288:cPsyMBzW+hNm5/WWZfeApLrY6xVct+LeIzl/lRIlRfk:qsxl05/WQeApwkVykhY7f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646839221, "uuid": "ed699d2e-a7dc-42ab-858c-da148ffd4694", "value": 837120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646839221, "uuid": "345ff471-eaa6-459d-a0e6-6fdce8b7b195", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646839221, "uuid": "118fa514-4d04-4704-bf74-a1dd71b0917e", "value": "c1e31db9bb0c6763f480482d5c70e1d6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8348c961-9fbc-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1646839254, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646839254, "uuid": "2e0ea482-0942-4f64-b5f3-786b7859faa8", "comment": "Malware payload (AgentTesla)", "value": "11c8baee59eb218fc0e3c52ec96168a5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646839254, "uuid": "6a5003b1-a9b8-4f25-806d-544eb4222138", "comment": "Malware payload (AgentTesla)", "value": "efbb010d372c4cd9daf73de6bb352c646c2daf8b159d3ce5885f3a802551e5b2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646839254, "uuid": "52f4f149-9d2f-4ac3-9d3f-d8ef84c55d43", "comment": "Malware payload (AgentTesla)", "value": "3d1ed160a5affd66c7acb93df7a417bd7f201387", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646839254, "uuid": "93f598d1-83bf-4ff3-a643-8bd0a19ade57", "comment": "Malware payload (AgentTesla)", "value": "812651ac628b4886a4abf9b581e07bb21dcc41d5b1a130ec0211e4312fad1ed655abe54a8882dc6cec015fcd95c9c942", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646839254, "uuid": "209ab0f5-7fee-4a45-af18-ec569be65189", "value": "T1A735BEE229EF401DF377ABB12FC8F8CE996AE973151A30DB11521B768523A80CD61735", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646839254, "uuid": "6588d0b3-e544-4951-87a6-f1776b8da338", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646839254, "uuid": "4bcaf22d-6885-41f0-8cca-670b230de9b3", "value": "24576:rD5kfjV9+/ef7nNNnY9knIiGr1b2egtSCK:rD5kfjVYmzDnY9IIVjgt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646839254, "uuid": "d0b019ed-92bf-4f20-b70c-e3d6125349c2", "value": 1106432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646839254, "uuid": "2c456e25-e97d-4062-8c4f-4b8b6f28a941", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646839254, "uuid": "e070ffb6-e68f-4fbc-9fbf-9e7f10abddd1", "value": "11c8baee59eb218fc0e3c52ec96168a5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d5a33a6-9f3c-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646784242, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646784242, "uuid": "c3b9699d-3243-4538-a367-d2df51748524", "comment": "Malware payload (Heodo)", "value": "8ab2a605c1d0fa008bf1c6e0ee4a058d", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646784242, "uuid": "f978b4be-bf55-4fe1-a1a7-8425f71cc2d8", "comment": "Malware payload (Heodo)", "value": "f01eb2b2884e09b180badb5cd762baa008c917703d5e77c57c87b665f0e11bf3", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646784242, "uuid": "21c01de0-7ecc-45bb-b7ad-51f93a6240b5", "comment": "Malware payload (Heodo)", "value": "c1f11b2c50b183382e02aee4c7997c48842b913d", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646784242, "uuid": "421ccdff-ef90-4194-b369-321a20a99526", "comment": "Malware payload (Heodo)", "value": "3ad0c59772bf8904d5db74eecd27628ec444c865ef902b33ae301bac8b1d2b118ead1ab5ef5246cb0230cb37fbf6f984", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646784242, "uuid": "8842f49e-3141-4700-8768-e44a0fdc2abb", "value": "T1AFB44C22E151E0B4C21744360607737DE60FADF01B95B277A3B015AFBAB5E71EE26326", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646784242, "uuid": "d98f8427-5731-4d7a-a101-58345053927b", "value": "c354d2e1bcc359dcb00a22865c038d4a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646784242, "uuid": "2733f429-2d77-40b7-a5db-b6551df814a7", "value": "6144:TMhEi6lq1EvTzbQJqnoibRcJQfTfYZsIhzED5TJycXo3ZqdK/J:hFGibRYQrAkoko3od", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646784242, "uuid": "c631f36f-7369-4504-89ef-63c27d921d9f", "value": 507904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646784242, "uuid": "316ed8f0-b4a9-4cb7-aad9-2b8fe42c1f04", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646784242, "uuid": "c0be73da-d33d-4ebb-8609-5e7313ccddb2", "value": "emotet_exe_e5_f01eb2b2884e09b180badb5cd762baa008c917703d5e77c57c87b665f0e11bf3_2022-03-09__000355.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22fc0712-9fb2-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1646834798, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646834798, "uuid": "a88cf4fd-1d7e-44ce-96a1-ac413520053b", "comment": "Malware payload (AgentTesla)", "value": "209d58f99c87e4e538dd31223e56ae92", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646834798, "uuid": "e28551d3-209b-47f7-8fcd-fe9efb3a89eb", "comment": "Malware payload (AgentTesla)", "value": "f032dca22e3958273a8333f93e89dc4ced10c10b671042a3e860e83e8aff2c93", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646834798, "uuid": "5b8a6205-3815-499d-8b35-2904027c010b", "comment": "Malware payload (AgentTesla)", "value": "25e5668e7c5e4ee5c899b2fc8f9e9caeeca1a05e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646834798, "uuid": "81042477-dad0-488f-944e-158213e7527f", "comment": "Malware payload (AgentTesla)", "value": "51d69e3dddfb37a46110d2f2c6bbcc56ac9dce397d8d60670aa6467a8e04b4d73b784bcf494dace1d1a76daafb176d61", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646834798, "uuid": "9dac1767-7011-4c65-b69b-b562b4b8cfed", "value": "T1B3B42358EA12B2D631505810D5A18E2919B11FB63DC592BC234C6E1CFB3F12FB2A7DDE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646834798, "uuid": "725da380-fa85-4f2a-ad24-d17862d5c1f9", "value": "6144:xS1O7Mi58ghpURjOcSFKk/fKjsHlZWMasUnAAhw4OYfKhJ+0V0RSzSjCzF:xn7TeYgjqKMKQl1asUnAAhw4gJN0Rn2F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646834798, "uuid": "9f9a2550-6f4c-4f5e-b494-793ddd552920", "value": 506065, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646834798, "uuid": "91b1863d-baf4-44b0-863f-c1774d8e7395", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646834798, "uuid": "b4bc1959-7cd2-4d0e-9337-db209191c681", "value": "New Order.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8902ea2f-9fcf-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646847424, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646847424, "uuid": "5e8ddd97-cc41-49db-ac6b-58ec7065522c", "comment": "Malware payload (Heodo)", "value": "f14ce297dc29a116f8e39e0794465980", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646847424, "uuid": "71f6fb9a-a415-4e06-8235-9912d873bf7f", "comment": "Malware payload (Heodo)", "value": "f040cd56b6e6dcc21f2784a4d93733d7db6c2d0b8060833e9c950b57795d204c", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646847424, "uuid": "9d6a388c-5d05-48e2-b0a2-0c43fe457e44", "comment": "Malware payload (Heodo)", "value": "d59959f0c0011ecefa977fd770b2e556da8e1ce6", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646847424, "uuid": "0f7a103e-2c2f-4f0d-bf93-f58305f16a50", "comment": "Malware payload (Heodo)", "value": "6a6d1629aadf051aed390b4572458d50c39edb89f88b7f668881d723e02571716a95c7f5005efe9e767df4a60027ac08", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646847424, "uuid": "ea04816c-eeaa-4112-b304-f9c7715ef205", "value": "T142D47B0023729872C3FF53760EE592F05AEE6DA1873101F735B872AD4A779D1A73492A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646847424, "uuid": "969bf169-6b72-48d2-ade1-aacf98d41280", "value": "bb2e319682f72745317e92a26483f973", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646847424, "uuid": "6d7d5d2e-cb0d-490d-8850-8a30ba62b871", "value": "12288:mc5R6LLnljSDIGRIyAAPIqjYtRL3CjzhmD/bwb1r8Hc:Bg4IqjYT320D/bwb1wH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646847424, "uuid": "8f6af1ff-fed4-4729-b511-1d4b2279694e", "value": 630272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646847424, "uuid": "96069b8d-f04a-4071-8fee-76ac3a9af516", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646847424, "uuid": "146814ed-6f07-4a5e-b7ad-cb25b9b5c8b2", "value": "emotionaldamage.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8ff9357-9f9b-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1646825225, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646825225, "uuid": "b7bd29b2-fd26-4735-8ad8-269f2e34729b", "comment": "Malware payload (Formbook)", "value": "3874ab832d81c752d9c955ef4fe3fc86", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646825225, "uuid": "1d816315-fd4f-4f1d-a4be-84c668dfb65c", "comment": "Malware payload (Formbook)", "value": "f0a3b64a941e0abb7fbc40e63dbc2cc1efe0822739280c0f6fab6b877bdf711d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646825225, "uuid": "01e6f9a5-19b4-4a98-908d-af5ea18add8c", "comment": "Malware payload (Formbook)", "value": "7324f9a69d54b5c04e943823ae370309a9378337", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646825225, "uuid": "2fe755f0-8a86-4b48-b6c0-1488942a23a5", "comment": "Malware payload (Formbook)", "value": "c0df81ae01f8ce8429efb85d7833e6fb2076d4175f0058aeb639b69e708d7993d81a9fe4c30759ab1c4a69ded184b594", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646825225, "uuid": "fdc6a1ef-6950-4629-b2e9-c23bb337882f", "value": "T12B059EEE77A09832D1232A788C4753B5A42DBD103F1464476AECBF0E7E395553E392A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646825225, "uuid": "be5014ee-eb11-499c-9a5c-aec84f8b4b1e", "value": "9a2305e23c811e08425371fd3caa41ef", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646825225, "uuid": "952c1b27-7b56-4505-8210-e7f935886b3a", "value": "12288:cPsyMBzW+hNm5/WWZfeApLrY6xVct+LeIzl/yRIlRfk:qsxl05/WQeApwkVykhB7f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646825225, "uuid": "1f2fef3a-86ad-47c8-abd0-962657f2775b", "value": 837120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646825225, "uuid": "b76ce21b-5be0-47c0-be36-04ca70f733dd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646825225, "uuid": "fd332a71-ab06-4dbd-9d11-a357c0daf03f", "value": "PROFORMA INVOICE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b452805f-9fc1-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1646841484, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646841484, "uuid": "ec2eb7ef-caa3-4266-accd-db998e9b8476", "comment": "Malware payload (Mirai)", "value": "d47376c824012113d4ff3e678ea877c9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646841484, "uuid": "84cadb18-ad57-467c-aa8c-cbbe65af6216", "comment": "Malware payload (Mirai)", "value": "f26c73ece1fa880f8751f0fbcc1d88576c8bbbc7da8096195799ba58fcf3a0eb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646841484, "uuid": "a45652b9-8c3a-4ae1-89b4-c5ccb306ee7e", "comment": "Malware payload (Mirai)", "value": "bbbecfbc2f3b467211bc67c36a0bd7a1971f3276", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646841484, "uuid": "10859104-2f8e-4c45-855d-d262c5e3c232", "comment": "Malware payload (Mirai)", "value": "696c3a8d501042862f4bfd3947f4def055b1cf51d3a3db3ef3f799c8cf0a12ec4e7b13eadee432f4a50711c4395675aa", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646841484, "uuid": "b1124255-8833-4acb-bbed-1fcd0d6edd75", "value": "T19C534A21A9793A17C0E8B57B22F38324B1FA670E24A4CB5E7D760F8EFF1454056172B6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646841484, "uuid": "27b8a1db-da19-4100-b6dc-64f7e6d8987d", "value": "1536:g7vgNHssSYrfARgwQQVZVntZa9cIzxYLhpS:dJ4aPlQzx8cIKhY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646841484, "uuid": "c79a7e4f-a05f-47e1-b742-7f78671c3c0a", "value": 63612, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646841484, "uuid": "44a3d2ea-9b7b-446c-91cb-917058540e48", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646841484, "uuid": "665abfa0-2712-4633-9bfa-d8ad3daf1290", "value": "d47376c824012113d4ff3e678ea877c9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "485bfef6-9fb5-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646836149, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646836149, "uuid": "cf4b837d-aa67-4057-a3d4-5caaf9958150", "comment": "Malware payload", "value": "b29a7d12e16a6a96e3629c3ba60c12b0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646836149, "uuid": "7ddc4cd8-8aab-4bbb-8a1b-d4ee4987f15e", "comment": "Malware payload", "value": "f29245e04b19948734b890bd4216a96e63612f8cc8e15251e2d576afdcc18666", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646836149, "uuid": "0111b1e4-3f12-47bb-a4e6-d453f0e4b45a", "comment": "Malware payload", "value": "03521c523f5bff0fce151b56f49891f9e74cabe1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646836149, "uuid": "ca8b101f-b354-4c50-b287-231c0eca97ec", "comment": "Malware payload", "value": "5a747fa691efa616cf7f92dd5c701b0a40ea9ee632f992ec9e3503e0e02e4d09d1f56ef080e8af8d6ed8f0208b6e9f1a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646836149, "uuid": "e6ef5f85-32da-44db-9490-90b55d8ab4ca", "value": "T1ED02B72667A4827BEABB1F3378A723401576F21AC826D76F5E48400E586337507F3F69", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646836149, "uuid": "67a7cac6-66e9-4c06-9a8e-01077a31beb7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646836149, "uuid": "2f36f8f9-57a0-45ae-a125-88d0d3b2ae42", "value": "96:DV0oLVZbGBSM2JXMY0q1J+DG9U62zc7+FonFoU4tT0ucf0WJ3Oq:jVJcY9JkG2lCQoyU4tyf0M3Oq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646836149, "uuid": "d8a179e1-6df8-4de3-b5ae-4f94491bf07b", "value": 8692, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646836149, "uuid": "88f79e89-873c-4882-ad6e-592b8a25e1fe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646836149, "uuid": "e0add701-6dd4-4c64-9ba7-ab93819a8f91", "value": "b29a7d12e16a6a96e3629c3ba60c12b0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8fa7a79b-9f9d-11ec-9275-42010a9c0029", "comment": "Malware payload (NetWire)", "timestamp": 1646825961, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646825961, "uuid": "6ee12af0-e51e-4f3c-80bf-aff98cdb8f6d", "comment": "Malware payload (NetWire)", "value": "691f6966d8041df5d641d9cb5025fff6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646825961, "uuid": "cce33204-de92-4731-b51f-4e0b8ae4d92c", "comment": "Malware payload (NetWire)", "value": "f2d6abfaf3e172ae26ef4afce1b1995c39cf8a47f971da517fef4fbf25d14d40", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646825961, "uuid": "c913d1e5-9777-40cd-b4c8-b50e5d9478a8", "comment": "Malware payload (NetWire)", "value": "2f2d56f44df0cbcc32d496d48d905b652d836e99", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646825961, "uuid": "68dd8cd0-cca9-4dba-9bc7-3bf26b82bb7d", "comment": "Malware payload (NetWire)", "value": "aae4ecc7d70c1e5c915c749273fc505bcdc3b58417c71bb706abd8f846d246f49a7177e73afa3bbcc4cc49ee596f2bdc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646825961, "uuid": "57b79335-17eb-4c81-b806-b37f6caf207e", "value": "T16113B782FEC855B0DDD9C73DACB3CE741622BCEA91B2A51C34C93E27B8B36904112567", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646825961, "uuid": "2a4046ef-1dda-473c-814f-b9b80eccfdcf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646825961, "uuid": "0b5bf0af-cc4f-432a-82ca-0b653231919f", "value": "384:9cmpcUZexO5wg1PB5ZR1LNTnEW+XIot3f4tgMYuo6EPXXHrzCHNr:CmpcyexOdRfNTEWCvugXLuH5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646825961, "uuid": "f781ab67-304b-4299-93cc-610a7db5170b", "value": 41472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646825961, "uuid": "83fe37f0-8295-40e1-a76a-8512f2bea9ac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646825961, "uuid": "214b1785-ad01-4e24-aef2-6344f05a22ce", "value": "Proof Of Payment.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64f7c24f-9f82-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646814293, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646814293, "uuid": "8baccb7c-6c01-4a84-b604-cc9fc28a1a5d", "comment": "Malware payload", "value": "9ecda40e1f5b357311253c71387376f7", "object_relation": "md5", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "nominatus", "colour": "#CFC8FC", "exportable": true, "hide_tag": false }, { "name": "nominatustoxicbattery", "colour": "#130B6B", "exportable": true, "hide_tag": false }, { "name": "toxicbattery", "colour": "#CFE4A7", "exportable": true, "hide_tag": false }, { "name": "Virus", "colour": "#FFCECF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646814293, "uuid": "ccf37c81-dd8f-4503-a0d8-bef2ee082dba", "comment": "Malware payload", "value": "f3210c79aa14c4cdc23aae147281140b7d1bdd8e38411a08ef2178fb2cdefd00", "object_relation": "sha256", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "nominatus", "colour": "#CFC8FC", "exportable": true, "hide_tag": false }, { "name": "nominatustoxicbattery", "colour": "#130B6B", "exportable": true, "hide_tag": false }, { "name": "toxicbattery", "colour": "#CFE4A7", "exportable": true, "hide_tag": false }, { "name": "Virus", "colour": "#FFCECF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646814293, "uuid": "a14dbca5-aa2b-4186-b377-1271566dd310", "comment": "Malware payload", "value": "0e1953505dbb994ea9ca2ae58e97d9b283ebae03", "object_relation": "sha1", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "nominatus", "colour": "#CFC8FC", "exportable": true, "hide_tag": false }, { "name": "nominatustoxicbattery", "colour": "#130B6B", "exportable": true, "hide_tag": false }, { "name": "toxicbattery", "colour": "#CFE4A7", "exportable": true, "hide_tag": false }, { "name": "Virus", "colour": "#FFCECF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646814293, "uuid": "8a5604ad-0b99-4550-8040-d96a9d6b4160", "comment": "Malware payload", "value": "b5db9dfb289e5f01fa87ab70535a9704ace43042a0b6c7735069f2e570208b805e277ce9bafa05162cbded8e50767749", "object_relation": "sha3-384", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "nominatus", "colour": "#CFC8FC", "exportable": true, "hide_tag": false }, { "name": "nominatustoxicbattery", "colour": "#130B6B", "exportable": true, "hide_tag": false }, { "name": "toxicbattery", "colour": "#CFE4A7", "exportable": true, "hide_tag": false }, { "name": "Virus", "colour": "#FFCECF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646814293, "uuid": "f77a8737-1322-4e70-9f6f-34f9ba4a7e28", "value": "T187E6F12572F44F15E6BBCB7E48B796950973B6C3E832C71A136D600E2B237909B52F12", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646814293, "uuid": "6d4496c3-b2e7-4a00-9b1c-0c00ed66e773", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646814293, "uuid": "84847c80-059f-42f1-ad1e-161790b9c21f", "value": "24576:qIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIII4:", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646814293, "uuid": "ef847e78-5cdb-421b-ad1a-5514c9f552c8", "value": 14456832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646814293, "uuid": "4d83407e-9ba5-4af1-90fe-ecf7e7f81897", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646814293, "uuid": "66025bd0-b0a4-49f1-9b79-f2f396702e95", "value": "f3210c79aa14c4cdc23aae147281140b7d1bdd8e38411a08ef2178fb2cdefd00", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ef73df6-9f80-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1646813477, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646813477, "uuid": "3615d312-ba7d-4e55-9bc9-f4de718525e9", "comment": "Malware payload (AgentTesla)", "value": "55686c87b84bc0229063ea20d9c309c7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646813477, "uuid": "7348e3af-0bbc-4616-9101-820e70afa84b", "comment": "Malware payload (AgentTesla)", "value": "f34acb7428b65cbdefc57edbdf1b8e1045955fafbbd8710f9ef302fa3d8ffb59", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646813477, "uuid": "9145fdea-cce3-4638-90be-76ad826023ab", "comment": "Malware payload (AgentTesla)", "value": "587daeb51836e7a8783f0dbe563e6bcba423f2c0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646813477, "uuid": "4b43cc5c-c531-411f-82e3-3caf9122f22e", "comment": "Malware payload (AgentTesla)", "value": "998041e7b06c3e2babfc7697df58ce682bf0a1aa87b5eb58e8932563f1cc2634225d2383b7748f2ca4b8127fd93268ad", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646813477, "uuid": "2209cc62-d5b2-4b81-a469-0d6cebdf5d7d", "value": "T16F05334EB49AC81C1F77423E867DEF69BFDDE94400D6A520DA05609B2613CB92C1FB17", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646813477, "uuid": "7ab0571f-1aca-4d23-aee4-008953d6f223", "value": "12288:MZQ8CfNoCNKQjgl4oKqRR76vNfrnIaykXw4+QSRafyVlP0Shgx0oI:DyCNKT5VRkf7IaVXw4LS8fyV1e0oI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646813477, "uuid": "e92d3eb0-d264-49eb-b7a2-be72d2b0b868", "value": 799688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646813477, "uuid": "a123ba81-6256-4b75-a881-8c8f726525cc", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646813477, "uuid": "f85b472d-9d82-431f-b35a-08151a9607b4", "value": "New Order.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d775daeb-9fc3-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646842402, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646842402, "uuid": "72f170f8-5b15-4010-b40e-de3c86dcd42d", "comment": "Malware payload (Heodo)", "value": "b7f87c8067c4533f9cdda8077c4e67e4", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646842402, "uuid": "ad26247b-8a78-4fba-bfe7-9a613cf71d96", "comment": "Malware payload (Heodo)", "value": "f371ab132127eb10e829968f2cfe67ab70a954ee8f93081984deb78fa44901db", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646842402, "uuid": "81d5f1ca-6de3-4a64-9c69-bf6add44f5cc", "comment": "Malware payload (Heodo)", "value": "4914987464da1a5fa4baadb73815bde28de1af32", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646842402, "uuid": "6985aa2c-7441-410a-8c6a-8655b1559720", "comment": "Malware payload (Heodo)", "value": "9bdb643f4b66171008356c18551a1473129d282ba06264728b6f9bd27f525fb4ba6d0c6308cfc51650257b39bb14dd4b", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646842402, "uuid": "af7034b4-c5d4-45c5-87d3-0d4ab61b8718", "value": "T15F257C107E8A817EC71B85B30836676D6FFEAB204B6CA1CB478175ED2D316C29B36705", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646842402, "uuid": "55289cc0-b81c-46fc-b551-edb9d845ac0f", "value": "087c9809507dfca4c3283e6c7539e91c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646842402, "uuid": "bf7a7c32-be01-47ab-b2b3-80e89f18bab6", "value": "12288:cR5SOyRHiA6m0OcElPzt6JtcS1j2xKkr:cR5SOrKlPzEtcK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646842402, "uuid": "7d58fdec-3c16-4fd6-aab1-a6915046ce13", "value": 1040384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646842402, "uuid": "bb46a8b6-2d78-445b-a4b0-f7116e524e08", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646842402, "uuid": "9c6eddee-1d97-4e90-a3e9-11610b13070e", "value": "MgBWKCfqOQE.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a3d5927-9fdc-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646852795, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646852795, "uuid": "17c458ae-547b-4344-a266-9201c9306e99", "comment": "Malware payload (Heodo)", "value": "a66072c4c39b398cd0c35aa5fa3464d7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646852795, "uuid": "fbafab8a-2c2d-415d-ad08-d8116e987cb7", "comment": "Malware payload (Heodo)", "value": "f381cd0b171a942eafb25bdfea60833bd0fd186de653fb27c3c2c5f74b9b7d43", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646852795, "uuid": "17afa968-e581-4c8d-b165-1ab3eabbf9e8", "comment": "Malware payload (Heodo)", "value": "c453e39044d97ac4be4b218802fbd403950f3918", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646852795, "uuid": "043e9e7f-c24e-4a51-9355-01c8eb545106", "comment": "Malware payload (Heodo)", "value": "5f2567b463ebf0a3dd5af8112de0ab26a9ae703069d6ef4c8b7cd9917e37ffce22f04f03df983f6c739882dcf07908bd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646852795, "uuid": "f746e7dc-e761-47f7-a64a-76dbdd099ba9", "value": "T18A257C107E8A817EC71B85B30836676D6FFEAB204B6CA1CB478175ED2D316C29B36705", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646852795, "uuid": "315de804-c066-4b3e-8135-00f876ec0087", "value": "087c9809507dfca4c3283e6c7539e91c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646852795, "uuid": "419bfe5c-000c-4e80-bf00-b15092c5c35f", "value": "12288:cR5SOyRHiA6m0OcElwzt6JtcS1j2xKkr:cR5SOrKlwzEtcK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646852795, "uuid": "22aa379a-c279-481c-b3b5-755cbec627df", "value": 1040384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646852795, "uuid": "d40240cd-0b29-46ad-a1be-cb3cb197b4df", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646852795, "uuid": "de1c60a5-d4b2-466f-80d5-8b478ea5afaa", "value": "a66072c4c39b398cd0c35aa5fa3464d7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6e81780-9f73-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1646808095, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646808095, "uuid": "1bb0dd93-7503-4762-bb21-cab39425a6ee", "comment": "Malware payload (Loki)", "value": "cd7fd890ea4a3e0254f6337f0a1308fb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646808095, "uuid": "4c3ae6bc-7c33-43e2-b762-75277d3ab8d5", "comment": "Malware payload (Loki)", "value": "f4989c44ae69ec60a1b824ec91a6c30e8382968a1c57acf7c0ecd036e02c2597", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646808095, "uuid": "73e8eaf1-ed60-4053-9bfd-531505f8b17f", "comment": "Malware payload (Loki)", "value": "d0d18436a27182ffe01b3d3cf8ee18e126cb57a4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646808095, "uuid": "24a2ded7-a063-4755-b3ea-903eb75a76e4", "comment": "Malware payload (Loki)", "value": "ba5edd5fe241be19535d8eb898f3a0deb692838d52741b523a29aaab3f3d6bda3e096dce48e0327be49b0e255b8db285", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646808095, "uuid": "d01f6209-d797-4f27-9fc7-f9fd1d399f96", "value": "T1FA033D027549B716C55E8A3A98BB9F043611BE31B042EECA74573E3AF433396990974E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646808095, "uuid": "7ce50a39-a469-4f5d-8ecd-d270fc032dbc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646808095, "uuid": "e4ec9722-9011-4961-8593-c3ba01dffae7", "value": "384:deFs1bnwzrHmsThuAtPhUAARvK08CJeMlPht3mLROT9x9/Q69uQxraY1:deFs1wduA5hYRvK08CJFLmFcJuQ5H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646808095, "uuid": "5f9f1198-eb8a-4c28-9124-e700e91869f7", "value": 39424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646808095, "uuid": "89087a92-ad3d-4398-9630-f378eea22a96", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646808095, "uuid": "906a92c7-9919-49ab-8d01-243d12db9392", "value": "5013020067703.scr.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb0842c2-9fe1-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646855239, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646855239, "uuid": "a8e8fcd5-ac45-47da-9253-e1aee6a8d9d8", "comment": "Malware payload", "value": "fe837bb2e1674cc7b4e7f82dc1036d14", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646855239, "uuid": "adbdd386-6b26-487b-a9e4-8b557d0b60c9", "comment": "Malware payload", "value": "f4a3d49109ebc49cde8dc2dde21b5645c8bb142d29f8f0477f977bb5cec7d3fb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646855239, "uuid": "13e3aa92-5591-4be2-932b-ed823f6b6031", "comment": "Malware payload", "value": "e8fdf187e11b93d7104ca565fad539b178fb5d4a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646855239, "uuid": "01ddf1e7-6eee-4c91-aee5-a68c6d4af1bc", "comment": "Malware payload", "value": "2363dedb3df332912e3db23b58fa2a335d3743cd6c602b5684a9596aa405ead716edfd381671ef03a68904d580f065c1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646855239, "uuid": "8c967326-63a7-440f-8ec5-63479484e82e", "value": "T1AEB423089C1A4D90D0D4AA35D4FDA2F48817EDB955FE53A86B053378DC97232768CEE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646855239, "uuid": "e69858ab-a5a4-4f64-acfd-969203f3b47b", "value": "12288:Y8hmVijJ/DnLSt7eUUkHNVUWa/Jaji0rHCfvE4Acc4x8RT4b0LR+W2:nhUiVHDUUkt6WCJaji0rH+MwcnDR2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646855239, "uuid": "d6e1d263-b03d-4580-afd7-c641f578affc", "value": 509339, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646855239, "uuid": "2fb5b929-ba59-44ad-a5a0-87d4cbead493", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646855239, "uuid": "bbfd9b76-088b-435a-a2fb-4d41b317b593", "value": "SecuriteInfo.com.Heur.Corrupt.PE@1z141z3.21198.2851", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e216813-9fb7-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1646836910, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646836910, "uuid": "3f8ea934-2f49-453f-874e-c1fce6be115f", "comment": "Malware payload (Formbook)", "value": "21fbe73b1ffcd9b36a4fed613e901bf1", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646836910, "uuid": "0f9825b0-8f8b-4554-87ad-390660f73355", "comment": "Malware payload (Formbook)", "value": "f50a048e567c1bf04467e9f26f300274b2cb0c4c23026968eb91346930383913", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646836910, "uuid": "d6f40388-ad08-4e31-8d98-93660b221681", "comment": "Malware payload (Formbook)", "value": "8e4754c557c60b1024cfc7add29cc58309503a8f", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646836910, "uuid": "3fd8b603-34e1-4e47-868e-f444c5205a7f", "comment": "Malware payload (Formbook)", "value": "b59d3d63067dfa580f9833e7348a34955d4561205f387cb36fb0123ca78980e68df97098303c07603b6c84a8dcaed84e", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646836910, "uuid": "cc9c8f3b-6c61-47f4-be00-e54b739a8910", "value": "T17AF423DD381E7186AD0B88B5451E2DAE2B8F0D51381FC40BA550E1CE4C6F89B8B7E7B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646836910, "uuid": "661a4453-18cc-4bf7-b128-f746de02b7df", "value": "12288:uFr/pkSF9x+wO+ixDUbMIKrVbrixO64/wWtc7UCODvRjYexXzebnOH4IAV:uFbF90v+i+bMIKrQxj4AdODJsexDeSXK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646836910, "uuid": "467784da-ae69-4fcf-b0f1-a56eb5da3c4f", "value": 732500, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646836910, "uuid": "35dbdfb4-963e-4d5f-acb1-009fd262b67e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646836910, "uuid": "cc7a1abc-63ab-4ad4-a8f0-8b79aeab0917", "value": "\u0428\u04b1\u0493\u044b\u043b \u0441\u0430\u0442\u044b\u043f \u0430\u043b\u0443 \u0442\u0430\u043f\u0441\u044b\u0440\u044b\u0441\u044b.Pdf.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf13b6b2-9fb5-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646836348, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646836348, "uuid": "ca148677-aedd-4094-a568-b4522c219611", "comment": "Malware payload", "value": "ede2383fedbfe802d56ec2cf85e8a1bf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646836348, "uuid": "8b6ee64e-845b-4bd1-8f9f-35362a22c411", "comment": "Malware payload", "value": "f607c65a219c8cf3a25a5a4338019a0814592c0cfaf5b466dbd0917167245ed0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646836348, "uuid": "422f83e9-46af-426b-9c7e-297b491b7973", "comment": "Malware payload", "value": "88d547f98b169939bd6f6a42c252d17f521ca456", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646836348, "uuid": "26bb4b53-16d4-480e-8263-778e70e21133", "comment": "Malware payload", "value": "ac348dfe3ab71c3b72a03bdac7e5a79fd5c30f9b3604dec9575d5ff6cf8f3c7e53853adeb2ac8e09bd7212ea202983aa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646836348, "uuid": "7210b622-8cf5-4cf0-b98a-851c25be2095", "value": "T1E1351200AB51D435F0FB12F8567793A8B52E7EE15B6560CB32D52EEA16381E4EC3231B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646836348, "uuid": "1407f2e0-bbdc-4cbe-87f8-f96b9530ce58", "value": "3eef4090e823297f158db506eb4add6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646836348, "uuid": "c4dc41c5-69dc-49b8-9ec4-0240a12bd373", "value": "24576:6AeCPccz+c2Y0x/J9HMVgYoClKf2IIUEGa+cW0A93du:55Sca/XYoClKAUEGa+wW3du", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646836348, "uuid": "2e644676-3104-4920-8770-a458fb70564b", "value": 1136128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646836348, "uuid": "ac981564-19a3-41ea-b248-164b1faa4fb6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646836348, "uuid": "ed606bcd-985d-456b-a958-3751f09474eb", "value": "ede2383fedbfe802d56ec2cf85e8a1bf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "812391e5-9fc3-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1646842257, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646842257, "uuid": "a959cd26-e564-4e74-9ff8-d1d990bd023d", "comment": "Malware payload (AgentTesla)", "value": "063c9072e3d0a303837de0db67e8a966", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646842257, "uuid": "d2a8087d-c9e0-4bb6-9acb-5212fc1df707", "comment": "Malware payload (AgentTesla)", "value": "f613461777f549fd3be4da0761d8a27a15568f9be88a3ac879f2d978b7bf2c32", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646842257, "uuid": "6114d6fb-6124-4c8c-9ae6-cb50e4209f94", "comment": "Malware payload (AgentTesla)", "value": "13af3ea7c6db6db191892452a665993a37b79663", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646842257, "uuid": "a2829d20-8fb9-4e0d-80fa-0b6c8aad8983", "comment": "Malware payload (AgentTesla)", "value": "2214363e65225b5e6f39e1bbef474f217857cbdacf9746a070dd1405101761b63f7d682d6d6e10099cfa2d546c22a946", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646842257, "uuid": "40d0ca2a-5bbe-4571-a913-848180b29cac", "value": "T12735BE10D9A6003AFD6A5B7917E2AC2346D7BEB62534A0AE5C1CF1950FF357E8C91C32", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646842257, "uuid": "dbf15005-a29d-41c7-b983-364c7196aa4f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646842257, "uuid": "c10c9576-3020-4e64-98d0-632caf71a165", "value": "24576:bKfCUV1BYhzmDJG9UxISmuWanlq8PzY0oRP3s2AYO:bu1uhzmDJGSCSPWanYEa3T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646842257, "uuid": "c36d822d-4267-4b7a-813a-3b9176c250ad", "value": 1126400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646842257, "uuid": "bc921c65-155f-4db3-aa41-0d68039b52af", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646842257, "uuid": "33e0afc7-1b70-4624-918c-b868e80e4eab", "value": "CHILE 2623ED.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60aae6e4-9fec-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646859812, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646859812, "uuid": "5aeb767c-54f5-44ac-acfe-86a27bc0cb78", "comment": "Malware payload (Heodo)", "value": "54abde73bbe2af502aba29ad30315f02", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646859812, "uuid": "672b677a-98e0-4bdc-aed5-69b5a4e03ecd", "comment": "Malware payload (Heodo)", "value": "f7afb6af4c61521ee7759ead5ab63862855ea92bfab18c39f07be749de44b848", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646859812, "uuid": "0b51a046-6dc2-4cee-943b-b179de49aa06", "comment": "Malware payload (Heodo)", "value": "c023e9202310ed9fee45f41ea1be75aa6e96713f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646859812, "uuid": "b52ff102-a0ab-4a4d-a532-268ee3af9b8f", "comment": "Malware payload (Heodo)", "value": "061cd84fa8db748ca8422138d628a1b561fb10531ab96d1a5ada182aafe8ef19a88049cfd522ba200d9e2637523d2e6c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646859812, "uuid": "2d3d4498-91af-4aed-8994-e678b0e24ab4", "value": "T1B6257C107E8A817EC71B85B30836676D6FFEAB204B6CA1CB478175ED2D316C29B36705", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646859812, "uuid": "4212f9f6-a47c-4478-ac98-7715d41f5264", "value": "087c9809507dfca4c3283e6c7539e91c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646859812, "uuid": "d3030ed1-d89f-4f3b-84f3-2e60c2258f61", "value": "12288:cR5SOyRHiA6m0OcEl4zt6JtcS1j2xKkr:cR5SOrKl4zEtcK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646859812, "uuid": "bb038bae-628a-4a26-bcf2-c963cb0aec9d", "value": 1040384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646859812, "uuid": "ddfcff43-95c5-4147-ab00-04fd4722cff6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646859812, "uuid": "74a7cc8d-8377-4092-9c10-7fefbeca721d", "value": "54abde73bbe2af502aba29ad30315f02", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61b6c6f4-9fdc-11ec-9275-42010a9c0029", "comment": "Malware payload (Quakbot)", "timestamp": 1646852942, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646852942, "uuid": "f2adbb66-8e9e-4198-ae84-3c6d26adc00c", "comment": "Malware payload (Quakbot)", "value": "bb74a815cc35d4a872b383df5fff9d77", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama164", "colour": "#6C68A0", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646852942, "uuid": "7be881a0-6b22-46f5-b0bf-14d424d9082a", "comment": "Malware payload (Quakbot)", "value": "f84c8bc723d545c434d4cd3b7ef9910d6ce07f63c6fa26ce06512bb365b9bcd2", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama164", "colour": "#6C68A0", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646852942, "uuid": "4e449c30-ac09-4c81-903a-0752ddef39a0", "comment": "Malware payload (Quakbot)", "value": "a0a48195961e221cbd6d5adaedfc06a2eb49fb5e", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama164", "colour": "#6C68A0", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646852942, "uuid": "ac502021-9ba9-4d2a-a6cb-a9f665377832", "comment": "Malware payload (Quakbot)", "value": "ab8499f75233d051d3599ce72fe2bfe68d846710909c0590392ebbe8377bc5c85aee2bf49ce1dbd02f560fe0fe939324", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama164", "colour": "#6C68A0", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646852942, "uuid": "1deb22df-8460-4b13-828c-bcd8cfffb1b3", "value": "T13E657D23F2C1887AD4761A3C9D1B739998BA79112D28F4C77AD44E8C1F37A433666393", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646852942, "uuid": "cb2fe9cc-252b-48af-9ce6-b2cbea6e9c51", "value": "cf78a88c4b0403a976a85038ec51a351", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646852942, "uuid": "5a04f589-cdf0-4ddd-9e1c-cc94f6434b06", "value": "24576:LP2GXxd5hyXOZk/R8SoMbEYN54UUrW/tRJfJ+OIU2SAHl4XoWSIgX4T:Lu8jI6kcYN9R+iKKgX4T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646852942, "uuid": "92ae5502-8bd8-4e5c-9dfc-b1003dff1123", "value": 1502720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646852942, "uuid": "08528e79-5d8b-41c6-b26b-a0fca95ca3c1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646852942, "uuid": "91eb9a7a-41dc-4176-92c7-ded427414032", "value": "6137077.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "331e1b23-9fe7-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646857588, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646857588, "uuid": "d344fcbd-e9bf-4779-8fc1-d9e36e80ffe1", "comment": "Malware payload", "value": "a59ee2cf258eb6c1976b396e84507af4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646857588, "uuid": "2aa6f1a7-f614-473a-a4d1-aa6b6ebaff7a", "comment": "Malware payload", "value": "f89dd765da63918dfa0c00ebfee562691d08503d50c48ca1dc06b77b63c46c6d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646857588, "uuid": "91e9d88d-13c3-40b1-8b60-16b59addfaf1", "comment": "Malware payload", "value": "07405327dcae75258b3922d68efd87849be72673", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646857588, "uuid": "1449dee6-2376-466e-89cb-0b70a7255545", "comment": "Malware payload", "value": "40babba3792d1b834049cfcb80ceda6a0cdce89efca76a5f57d61286d07fc81f6504192d380ca5de24b16beb4326e054", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646857588, "uuid": "671ce07a-78e7-410b-a916-3dda875f028f", "value": "T1C5539DD03186907CD4EAC9390AF8A3E82BF5B8D5D497C58F5F725E4316A238B2B1171B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646857588, "uuid": "5fc3229c-5462-4e45-a443-eaa49cb6c068", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646857588, "uuid": "f4a2a88c-1f38-4abd-b7d9-8bbe19e03df7", "value": "1536:PsDbRiT9d7SPcGplQvVVMKfEJmG11yf2sv9h33+8LRb:PsDbm9dmPcGjBryOMvb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646857588, "uuid": "439d6e5d-3e71-4490-8abd-24d848a0da57", "value": 61440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646857588, "uuid": "0933ec37-c3d3-49b0-9bcb-05ea44398a56", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646857588, "uuid": "b3783d89-6ca9-43f6-8418-cc50cc56de57", "value": "a59ee2cf258eb6c1976b396e84507af4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bae0c2cd-9ffa-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646865976, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646865976, "uuid": "66c4f03d-e2c7-4786-9f86-0303fdde44c3", "comment": "Malware payload", "value": "2d018b37feeb7644dcfdf9ae17b1ed65", "object_relation": "md5", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646865976, "uuid": "c5688f08-0e99-4a66-ae69-a5ac4d0b35fe", "comment": "Malware payload", "value": "f8a8588a7a3cf9a22758519cf7ece49dfede6aec3670e7a558f8dcd2547a7cbc", "object_relation": "sha256", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646865976, "uuid": "5aaabaef-dd4a-4283-9023-bbd7200eba7a", "comment": "Malware payload", "value": "41bafd97e2e91d96464717af475050a81331e278", "object_relation": "sha1", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646865976, "uuid": "026cb0cb-a071-4cda-a69d-2a5c164fc615", "comment": "Malware payload", "value": "5b2b6ec308a79c0d7c6d9f05ef8e1b7352410182911dfaa9aac5cd537bb8f19e5daf4e618fbf11b0cde4a56b4754d9ac", "object_relation": "sha3-384", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646865976, "uuid": "be427c97-64d5-460b-a051-5bddefdb6694", "value": "T1E613D02CE65B3119C6359C7D561CDCF56E0821975409DA8B2848FBCC2EC1BF722AF19D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646865976, "uuid": "c6789d38-98c2-4ce2-90a2-4262ec6dc90e", "value": "768:FCToSyUnZpOw+pyZfQCwBzii1H/KNsH7meB1Id5qXkm1qVw0je7:FQsUZpOw+pyZfQCezfCNRejIdcXheRj+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646865976, "uuid": "35763063-2bd6-4336-97c5-d7eaea5e209f", "value": 44632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646865976, "uuid": "b72516b3-581e-4931-9fa1-32e5f73ed035", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646865976, "uuid": "679ee5dc-2347-4c7c-802d-5530e154f79a", "value": "Pack-564.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "686e7806-9f78-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1646810003, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646810003, "uuid": "8e956c9d-71ad-4566-af7e-22a6ec746d2d", "comment": "Malware payload (Formbook)", "value": "e85a3049eb806544ac7dde3844b4ef2d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646810003, "uuid": "351c7edc-735b-40c4-8e27-49e8b588b3d1", "comment": "Malware payload (Formbook)", "value": "f917034d08d7cc2d2af50ff28d1b52944691fba6bb96965e18948cf7473bbd80", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646810003, "uuid": "d75518ba-c86a-45da-b49d-0bbe14756d0d", "comment": "Malware payload (Formbook)", "value": "a2bbb2e0eea141781d104ca9cb8d5b1965df5130", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646810003, "uuid": "b92b18e0-dcee-4bb8-afaf-b9a184a9840b", "comment": "Malware payload (Formbook)", "value": "2a951d438b69cef7c522e83183d9b1fd19e1145b5b8d6dcd9647689eb1983e11af4bf86004395e01a8a340e18f28bd03", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646810003, "uuid": "54a60d5d-8d64-4dff-aaa7-de3d93df12da", "value": "T15C059EEEB3905837D0331AB98C0B5374642DFE112F2464876AE9FE0E7E355653A36293", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646810003, "uuid": "86ec35f1-947f-47f8-966c-56812f13f179", "value": "9a2305e23c811e08425371fd3caa41ef", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646810003, "uuid": "999ad465-b703-4160-b39e-e24527564c42", "value": "12288:cPsyMBzW+hNm5/WWZfeApLrY6xVct+LeIzl/CRIlRfk:qsxl05/WQeApwkVykhR7f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646810003, "uuid": "7d9bc831-0e89-4f55-a1ea-98d664febb24", "value": 837120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646810003, "uuid": "aca3439c-683e-460d-bc11-5c87302b2666", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646810003, "uuid": "abee89d3-4ffe-457a-9b67-466dfde42fdf", "value": "Request for Quotation.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36ac2c46-9fe9-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646858453, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646858453, "uuid": "e1138cd3-832e-41f7-a5dc-f9376ab3e10f", "comment": "Malware payload (Heodo)", "value": "e745c7d5d04445a2a7f496d1c1b2642f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646858453, "uuid": "a00df865-65e6-4dd1-906e-e6142c8aacc0", "comment": "Malware payload (Heodo)", "value": "f9cd8cabd503857ad23a9f6a00d71a959bbc320e0af35861f23c1a4fc8e31a32", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646858453, "uuid": "502a43a3-7c42-4b83-af4c-b8655b694701", "comment": "Malware payload (Heodo)", "value": "88117e186796d9e621c2080b05487c96f161fa22", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646858453, "uuid": "5208c9cc-0655-40a5-8a7c-3fd7dc098443", "comment": "Malware payload (Heodo)", "value": "f30f312f4f81aac348f06c2a96f03032eeb24cd6990fc3c75cf20cec8aef28f30a4e5f60fec664211e5992b7cab8e972", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646858453, "uuid": "293fddf5-8adc-498f-891d-ded6fb773bf6", "value": "T108257C107E8A817EC71B85B30836676D6FFEAB204B6CA1CB478175ED2D316C29B36705", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646858453, "uuid": "3b40f8a6-9eb4-4491-860c-674a3f0fc3f9", "value": "087c9809507dfca4c3283e6c7539e91c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646858453, "uuid": "8134657e-71b4-4634-9e99-14951bde709a", "value": "12288:cR5SOyRHiA6m0OcEltzt6JtcS1j2xKkr:cR5SOrKltzEtcK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646858453, "uuid": "6effc041-d618-4bb9-8286-2785f496bd0e", "value": 1040384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646858453, "uuid": "6b7c2d16-1a90-48db-9990-62ac8f06e670", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646858453, "uuid": "05890d3b-65e6-435f-93ae-281b294ad1d2", "value": "e745c7d5d04445a2a7f496d1c1b2642f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2fd6e92c-9fe7-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646857583, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646857583, "uuid": "45544ffe-7565-473e-bb18-94f21b4741be", "comment": "Malware payload", "value": "3341d4f80974b3a3100facbd779cd06e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646857583, "uuid": "14030dd4-3b04-4114-b126-ced1ef1464a0", "comment": "Malware payload", "value": "f9de4c54c54f11a87b22ffce3e9e19f6a5dc402ef1f0fd133ca07f4b83f21da6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646857583, "uuid": "2e1833a5-de41-4f6b-9fbc-9fb55191881f", "comment": "Malware payload", "value": "d501e32871ae1b646de5d243a0670b0267b4f721", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646857583, "uuid": "a5019dcc-e375-40fb-b987-21b07cf38b7d", "comment": "Malware payload", "value": "408b77a85869c3d449c2298692716aa6ae197e11624587a94f9351c30b7c9834ac92feaa32151145ad3a936375bdafd8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646857583, "uuid": "08699f45-99cb-40b8-bdba-dea8f3f2ab40", "value": "T1BC438DF03588A47CE5EDC23509B692EE63B4FA85D683DA8F5E706C4705E6287370264F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646857583, "uuid": "e5690c18-859e-4319-8f96-9455f06b7b48", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646857583, "uuid": "86179e1f-d310-405e-94f5-af8298760a83", "value": "768:6DXwIVo3qv4EqPSDRauLxYjx8JYlnGrATHTmIDqVnvMUG4NCgt6MrmxdmlFEvtqg:mluaAmDRaAxY98JmHO2UHiS609ZHh8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646857583, "uuid": "77dd71e6-bd5e-431b-82ce-3d769157ea21", "value": 59904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646857583, "uuid": "e50a1750-f8ce-4ea0-a6f2-4d3acd1cb08e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646857583, "uuid": "bdd5de78-d7f0-4007-8aca-84bf52240b91", "value": "3341d4f80974b3a3100facbd779cd06e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7de68ebe-9fc4-11ec-9275-42010a9c0029", "comment": "Malware payload (Quakbot)", "timestamp": 1646842681, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646842681, "uuid": "6e735477-f7db-4c91-a9db-3071bed770c0", "comment": "Malware payload (Quakbot)", "value": "afb6627a8c56f0c981250fec9c74cebe", "object_relation": "md5", "Tag": [ { "name": "obama164", "colour": "#6C68A0", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646842681, "uuid": "6a4d31a3-03c7-4dae-af23-7ec7848a552e", "comment": "Malware payload (Quakbot)", "value": "fadbd61772266a8de153f4f1470f255fab37f34d20715390bcbf90a3b089bbe2", "object_relation": "sha256", "Tag": [ { "name": "obama164", "colour": "#6C68A0", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646842681, "uuid": "1f61ab5e-1bb6-40df-b56e-b6e6cc6b6342", "comment": "Malware payload (Quakbot)", "value": "aad27786a9900d46ac134ce767b8ccd09708d4aa", "object_relation": "sha1", "Tag": [ { "name": "obama164", "colour": "#6C68A0", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646842681, "uuid": "ca4cc2a2-8e63-4dec-a927-c94fda2a9ebf", "comment": "Malware payload (Quakbot)", "value": "b05bc75fcb1667112bac99690b14a661bb292e9b0cafb1326384f250c8d84c9b03662a0e162da7981d006eec913e2fe2", "object_relation": "sha3-384", "Tag": [ { "name": "obama164", "colour": "#6C68A0", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646842681, "uuid": "b2f4978c-29d6-4821-9318-c62852af559d", "value": "T1F534014DE089EE1FC2F32479D70C78E14B0A428664B6F92E16E9A6449C734B7D7AC35C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646842681, "uuid": "2f2ed9e6-572a-4e15-b4e3-2ec143acd286", "value": "6144:NqzT1f1P12a13jTFPvVE6A708uVOnYxR+BupNrDVvxMirJS0jZ4Ko3FtcDKK:IxZ12yTxVkVok4rDVvxMirJvj43TK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646842681, "uuid": "501869db-5da6-43c6-9516-dbb48a8aa1c0", "value": 241987, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646842681, "uuid": "cd05ce90-b5d5-4225-9740-1cdd7bc98b34", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646842681, "uuid": "b7c21dce-8cd8-4324-9d9e-4ef9a2357ad6", "value": "EmergReport-1426643848-20220309.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ff4977b-9fb6-11ec-9275-42010a9c0029", "comment": "Malware payload (AsyncRAT)", "timestamp": 1646836645, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646836645, "uuid": "114ba3c6-aa13-47c8-aa8f-f26b479b5fa9", "comment": "Malware payload (AsyncRAT)", "value": "cbe411671e4313df9f9362043dada9e2", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646836645, "uuid": "6590cce0-2c85-4e45-8eae-75e4147e237d", "comment": "Malware payload (AsyncRAT)", "value": "fb000322ccae333ffeb91931e4869225c65997094bc379f8fd85c977eaf85527", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646836645, "uuid": "8c853d1c-18d7-42d9-8dc4-3941313e4b8d", "comment": "Malware payload (AsyncRAT)", "value": "2056ceb5c899e8bbdc98d0ad07ce54d88a99cd46", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646836645, "uuid": "d57dc157-b8f0-4b11-b9de-3767ea7c7f08", "comment": "Malware payload (AsyncRAT)", "value": "f6b78266d86733157dcc76efcf662cc7deb99e35d47a7fd66c7624ed7e7d1c523383060fd2655e04c1c6a8f35be767c8", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646836645, "uuid": "d3eda3d0-e68c-4dad-9ee5-c35dc2a23609", "value": "T134226DEA78BD2E43CD6B9091A175FEF6C2EBF65911FB3286705DF4E60761B212E01480", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646836645, "uuid": "e647dd56-c7c4-45c4-a9f1-543a83e44769", "value": "192:DpL88rtjK1kclp5ScjX4g37FCsHvZhylEdq0n/CCFB68:Dh88rtxE7k4vqlELqSk8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646836645, "uuid": "5b163ea6-6e8f-43ed-ac8b-a359ca2cc8de", "value": 10603, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646836645, "uuid": "2c084206-9dea-4beb-8d47-b1f6eb91ff16", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646836645, "uuid": "9ea0302a-d1f3-4d0a-80b8-c1dee2897178", "value": "Fancourier 09032200754RO.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2795efac-9fb5-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1646836094, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646836094, "uuid": "2951f3c4-3b51-4712-91de-54393f5a1974", "comment": "Malware payload (AgentTesla)", "value": "b9e0654206168601de6a4ba428791431", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646836094, "uuid": "b7a7e408-45fd-41bb-a14a-c5cc4c8bac57", "comment": "Malware payload (AgentTesla)", "value": "fb7d841b757d358d483bc9f10dac3eb083fb0dfbfcb3a09d2b2da0f0d5a09da0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646836094, "uuid": "ffc0c37b-50a7-4400-a48c-c59594e30b93", "comment": "Malware payload (AgentTesla)", "value": "de23ebe39205ee27466c0765667198a541efd3aa", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646836094, "uuid": "c39fd6a5-861a-4a07-b918-741fc1fb2db2", "comment": "Malware payload (AgentTesla)", "value": "211a3c0b6e8c17a3f5bd14d02e246b580f3a1fcc1f69098247327fef34748947fda212fcf41602de1cb3f42f9311227a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646836094, "uuid": "c051fff5-5f32-4ffe-8ec3-a91394fc2a24", "value": "T1F8E423A02D404AA58FB23FBAB34D9F68BD70A44B5C5762F5E0187354587323AEE1F44B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646836094, "uuid": "8653617a-c007-489f-931a-1ed0ca57a644", "value": "12288:zCV/92I5mk7Snf9b6zeCXvSreZpkXdDY0h8Ig5hCIfe7lSNUr:uV/9vD7Snf9bcFseZKXdDY0h8Ig5hCaO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646836094, "uuid": "ff92f4f9-94b7-43d2-81ec-ba3ba58dac3a", "value": 659848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646836094, "uuid": "bb6adb22-8b6f-4f04-95ff-413a7320da96", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646836094, "uuid": "f8b79ec6-5856-4dbb-876b-e09e853d3f0f", "value": "Order.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e318a5d-9f85-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1646815677, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646815677, "uuid": "b29c01be-c728-4349-bbc9-7594ebb06bc0", "comment": "Malware payload (AgentTesla)", "value": "b6f383e0bac586531b4d6203eebb72e9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646815677, "uuid": "fa2eb0a0-f84c-4762-971e-7d13db4f4ce0", "comment": "Malware payload (AgentTesla)", "value": "fcb520c458fe0b9614d1d890b8b694d109ab8e15f83b729edd40cfa90ac6d27f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646815677, "uuid": "7b9fc97d-bb36-426f-af4d-57e9e1233e65", "comment": "Malware payload (AgentTesla)", "value": "ea6a080a9cb71110c2a75ddd310b7ee6059fdf92", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646815677, "uuid": "2a7f1204-b305-4878-b01d-a184d7d16ddd", "comment": "Malware payload (AgentTesla)", "value": "9b599a124351cb7ed5737329a69bbfb13e8b0289d14dd434ec7f2cfcdf30113bfdfdad48c80effa30c92c729a203dba9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646815677, "uuid": "3828fa2a-c97e-4930-8245-5709e84dd57f", "value": "T16584238891CBDC503375FC6E0F4BFBD939D89F8E5A05FA6A022DD5E0266E8597402CE4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646815677, "uuid": "84d8f761-aeaf-4a99-8593-2a4f008c96ad", "value": "6144:4lfBEWTg+RW8NnjMXdmhtF/6WLFq8188A+BiqcDZ6psVC/oj2cKS3m34bJSN7+sA:AfBTTgXdM76WpqoViqj/ojFKFVo5iCV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646815677, "uuid": "342491cb-646c-4b70-9bec-f251e269c0da", "value": 403616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646815677, "uuid": "b3e4a313-cf71-40e4-85b0-8c541c390200", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646815677, "uuid": "e4218c1e-574c-45b5-a741-339db25335f7", "value": "CUSTOM DECLARATION COPY.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d854a39a-9fba-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1646838538, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646838538, "uuid": "f74cb6ae-05bd-4003-8fcf-85a36978f07f", "comment": "Malware payload (Formbook)", "value": "9ccbc75d53c50289caaf20c07563a6e3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646838538, "uuid": "ea498a27-94fd-4518-9db9-34798d4cd9cd", "comment": "Malware payload (Formbook)", "value": "fce5596c2d1dac776fe4dbb63e6b7633840eb7926af26bf5d9ec976600f1043f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646838538, "uuid": "18e34ff8-5de3-4f10-9b9b-36b5d94f2dc3", "comment": "Malware payload (Formbook)", "value": "3397fa08450fca7fdb652a4da7e20501aa9702f3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646838538, "uuid": "f7a29e12-85f4-434b-ac84-ce5c57fc05a6", "comment": "Malware payload (Formbook)", "value": "5f0a9657f55f584b0e6f6b08eb30c2c37ad325ab2285018422f3b67df2ea383794b976f1a0ae727230bb025f58c638f4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646838538, "uuid": "17489ee7-a03e-4649-82dc-24e72d70923e", "value": "T121A401587086E94BCBD071785FB1DAB997B1ACDD09548A232AF43F5F3AFC06762012A1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646838538, "uuid": "6773ea21-148d-4cf5-a09a-3b208d1b1c90", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646838538, "uuid": "ce880a12-6108-4f48-9869-5d9ae90eec4e", "value": "6144:8Gi2xiJVnf0Z/Mvk+q2XQLTe3T179cINQtkkbbrb5P8L8pwNO8eeHtLOr6i4:+nG/D2Anqcrt5P8uiSYtLS4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646838538, "uuid": "6a94acf9-e817-4745-802f-e7eabc5dc9bd", "value": 480145, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646838538, "uuid": "de6374c0-4627-4cdc-84fe-95cf6fb34dc6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646838538, "uuid": "33b94ffd-abe6-4259-a7d2-deddb5d7ffc8", "value": "Dekont_CA00002872390.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55c81e5d-9fa9-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1646831017, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646831017, "uuid": "dddf4efb-767e-48d1-855f-7985772d4da6", "comment": "Malware payload (Mirai)", "value": "d0fa931e5eaa84e2bb731fd79df8dca4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646831017, "uuid": "0e707b21-d24a-4f1b-979e-4bf6d1c7e6fb", "comment": "Malware payload (Mirai)", "value": "fd2bc8747679101e7f98cf48bdc734c8d086aa77f1dd321fdc3f7a6035d7036e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646831017, "uuid": "4f46b1c9-834f-434a-8059-1b3af0dc7966", "comment": "Malware payload (Mirai)", "value": "eda7d2f1b9cc2f56dde59ad3347b78a23f185027", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646831017, "uuid": "f46cc55f-556c-480c-91ba-670c4e9749df", "comment": "Malware payload (Mirai)", "value": "c556c14041e4a2098e56787530ef7d3156cf3ff8d68f3bf97f40412e6228177dea985e5b238b415cd1f7185d15d8eb3a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646831017, "uuid": "43fe3bbc-da41-42cf-8e9c-a1d5962bb46f", "value": "T161833924BC391E27C0E4A17A21F7C722F6F5228D21B4866D3D710F4EBF656407A47AB6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646831017, "uuid": "e425afde-9753-44c8-a49b-a2e71ba9178f", "value": "1536:FrWZnHJSkunDANOJpkGJ1+fUH4ZtNMMCcz75ZXbtAR:xWZQJ0sCft2zczVIR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646831017, "uuid": "a13bc1f8-9113-468e-ae35-9a1a4fc90943", "value": 87844, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646831017, "uuid": "7bba18d1-a5f6-40d6-888f-def0ed449d16", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646831017, "uuid": "08319119-3871-4c69-8f08-3f568885ac0a", "value": "d0fa931e5eaa84e2bb731fd79df8dca4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b6e349c-9f75-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646808666, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646808666, "uuid": "cac6093c-b103-4a37-ae7e-4a91732d4d06", "comment": "Malware payload", "value": "85f3c53e1b67a1895cbd8cddbb0185ff", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646808666, "uuid": "4d7ea4f2-aacc-47af-beb8-2004515edf1d", "comment": "Malware payload", "value": "fda35cece63310cf205317722754efa6773e9faa0b787dcc7dadf46a7da10383", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646808666, "uuid": "6aacc836-cece-41e7-861d-f050a69c4cf7", "comment": "Malware payload", "value": "608ffef22203b8742f6dc6be6698d60e57cbed70", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646808666, "uuid": "e56b19a7-3783-4a3c-a87e-0e006ca62f70", "comment": "Malware payload", "value": "e147ea3cc4c5088d40ef9912319f515c20f74be619939fde38073451139388dcb56f271d0ba059e4e02dffa3d897e7c2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646808666, "uuid": "fa098064-6bcf-4a05-9818-082b8553d012", "value": "T1F4163303656067E8C6201CB3626A04C78A8B4F355FA4BA255E5FEF5B066367C37F0E1E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646808666, "uuid": "01e524f4-4e36-4759-893e-1d594ef5b90d", "value": "511cff895609a1cf1f0a80aeee92ffc8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646808666, "uuid": "220d1a4a-2be0-4fec-b1b2-df194211c622", "value": "49152:rHmfql1HTJcAFqMEjmtQXxD5qCfhZijRreK9e6F0PH6bLnfssIjZqMgMDb:qfwtFlEU45f5ZuD9x++Lnf9iGM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646808666, "uuid": "ee641d7e-fce3-4c00-b45d-1b6d5b8769d3", "value": 4044288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646808666, "uuid": "3fb78c59-e101-4207-bb75-ba9972a562a4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646808666, "uuid": "54d2351b-994c-499a-82a1-a9c05bc3bdb5", "value": "Main__Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23df6b79-9fbc-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646839094, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646839094, "uuid": "6328c01e-404b-41c3-8ed1-068fd68a2bba", "comment": "Malware payload", "value": "58738184d0883f919b53931adca4270d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646839094, "uuid": "6ad57427-a2e2-415a-8b1b-266d2b2af6e9", "comment": "Malware payload", "value": "fdec646f46aa1b2f02c6c39dee337661872c2cbf93d9e2e699ce8486d997567a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646839094, "uuid": "0b22fe70-c060-4a9f-a9b1-d804270db854", "comment": "Malware payload", "value": "23e5a0be2dbe1a64aa47125621b10f6b92a2a3ca", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646839094, "uuid": "ee20c6b2-667e-459f-bf6b-1eaf74534e1d", "comment": "Malware payload", "value": "2987958d0bcfbd149fc23af05873c4299db07e5923f7acd786dfd043014385ee3f93d2b217db68d3742eca59cecb5445", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646839094, "uuid": "479c9f77-df85-4d14-bccf-f65329dd4f4c", "value": "T19B563303B68D97BEEA261E707574923029689F632F358B5B73D0DD7D8A7105CA930BC2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646839094, "uuid": "2da6b424-b8cc-4ddd-95e2-c8adea816b99", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646839094, "uuid": "071a3869-061f-472e-b8f4-0a56e2617513", "value": "98304:h76HYGHUKMWIOZLNP009qjP+WgbpU09/PMKjoHDzQ8AAW1llu4c:J8dUAOFyJ9PM0oHDzK91ll8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646839094, "uuid": "663a6d46-c88c-46c7-8d5f-727200c9bb65", "value": 6387831, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646839094, "uuid": "7e082dde-7196-462c-a13c-203e2f977b91", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646839094, "uuid": "57025872-f6e6-4520-90ff-1bc8407206d8", "value": "58738184d0883f919b53931adca4270d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37fddf98-9fc4-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1646842564, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646842564, "uuid": "f4025655-e196-4d1c-8967-c2ecfa84d803", "comment": "Malware payload (Mirai)", "value": "6dbd33b84860a4aea720073501ac319b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646842564, "uuid": "cab11643-55f7-479c-a5c2-ca69a332c43f", "comment": "Malware payload (Mirai)", "value": "ff80377f6ef3bd415e672cae30ec37e4ae7f0307374801fcdd3c6ab6e8952675", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646842564, "uuid": "a5809eef-33c4-4150-9620-eb9085bced80", "comment": "Malware payload (Mirai)", "value": "7f7eb7e4d00fd1b967b085c808cc637441c905eb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646842564, "uuid": "1d4f3363-1c99-4ccc-9bf9-c721080a0d18", "comment": "Malware payload (Mirai)", "value": "88841fb0c1928743266f2ff948072d7d8068f1657047ee8bd6e59c6dbe3da720a15573b2177976210352368eb971e915", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646842564, "uuid": "318282ee-aba6-4db7-8146-8cee6a0478dd", "value": "T1B3C2E079F08E9DA8EBFEA6F15F5946C977908FD239671B806047EB802E01621571EFC0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646842564, "uuid": "0bc208ea-b1e0-4121-8e4e-ed26d50225ee", "value": "768:IR9kCmLF0MCzQug4gaKmYxZOfpNgz4uVcqgw0X7JkmWy:4/mL4zQagPNZ8Gz4u+qgw09X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646842564, "uuid": "7a2db716-416a-41c3-88d8-c6bb3dd166c7", "value": 27784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646842564, "uuid": "83c14b1a-ea69-4a49-8bcc-41fade5d2afa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646842564, "uuid": "cdcf6075-492e-4a61-8fbb-969b52545bc8", "value": "6dbd33b84860a4aea720073501ac319b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11d5dac6-9fb7-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1646836916, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646836916, "uuid": "b93f8638-8047-4632-888f-c76a75fc1403", "comment": "Malware payload (Formbook)", "value": "fe0897634eccc1b02ef01c99d2eb0e71", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646836916, "uuid": "d56a2719-a2c6-4224-b889-8fb419102517", "comment": "Malware payload (Formbook)", "value": "ffd04d82156eede57a242db418b539e9ee13aa1bf5123df96db273c0f6f6ce71", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646836916, "uuid": "3d14bccd-4ad3-46a6-b99c-e85f7ed8f786", "comment": "Malware payload (Formbook)", "value": "031bbcb805e502dd2c2950e5e73e9e3790397d6d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646836916, "uuid": "5f8b17a4-580a-4a99-86ba-f676dee5c439", "comment": "Malware payload (Formbook)", "value": "c69ba7e1ebe1c90406f61aec3f25e87b27ee90b0e141f2fc40d5bba4852ebf86a47d03c1f54c458285c4c4c2d9e84f0d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646836916, "uuid": "13b7295a-912d-48cd-97d9-458fbef8b8ec", "value": "T1AE25AEE629EF505DF3379BB13FC8F8CE995AEA33151A60DB10912B768423990CE21735", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646836916, "uuid": "12b17f9c-ef61-4290-bcd5-856b1369509f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646836916, "uuid": "353244c1-1808-44ee-a0a6-08f6f4698f48", "value": "24576:sD5kXfavkiKbMIq9Od1kANO3ZMUFxekLXI:sD5kXivKbr7u3ZM2EkL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646836916, "uuid": "1ef1da22-c8d9-4397-bd46-9b02828ee14c", "value": 991232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646836916, "uuid": "0063fe58-5118-402f-83a7-2942aaf6ec8f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646836916, "uuid": "06338d01-933f-46bf-a724-a1bae5970903", "value": "\u0428\u04b1\u0493\u044b\u043b \u0441\u0430\u0442\u044b\u043f \u0430\u043b\u0443 \u0442\u0430\u043f\u0441\u044b\u0440\u044b\u0441\u044b.Pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4417baad-9fd1-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1646848168, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646848168, "uuid": "6413aa8f-17dd-4069-a5c6-42aee3f3fe06", "comment": "Malware payload (Mirai)", "value": "42c46547253d76fd0c0483b0a9ab7f01", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646848168, "uuid": "fb36d4a8-7b90-411f-998d-68f3eed21002", "comment": "Malware payload (Mirai)", "value": "ffecd0f0477cd480931a11e2557a7948a1c117850c7f665bf8d6fe5c38d7c9c1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646848168, "uuid": "3beb15fe-3bd0-409a-ab4f-a78559055b0b", "comment": "Malware payload (Mirai)", "value": "da16c3fec9e8a5b375c0492dd8be8b98e6d3d4bb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646848168, "uuid": "23b8865d-6060-4dc4-b445-7ba02c49ba7d", "comment": "Malware payload (Mirai)", "value": "892a110826e521370e7bcc430f4f6e22d921776bf6d4dc6b4cdb6d2924132ea157dcbe8b3298a9f7f4b8f33dac56054d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646848168, "uuid": "4d784b2d-797f-40a4-b4b3-62eaf883dc4a", "value": "T1B6230752BCD28A56CAE42376FA7E02CD3311A3A9D1DF7267CD205B10368991F4D77B82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646848168, "uuid": "b53cb36f-649e-4c6d-b304-ab091ca35a67", "value": "768:9bfvA1RUGzxhmlgTgDqEVd4YrLOPsiNiepK0eRAw1V+6ogaMkofEBNqEdY:hnAnF3mmTgzLO/NppK0eRpP+HkY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646848168, "uuid": "e86aeef5-c198-4a0e-a9b7-4e06f8b7d8e7", "value": 46320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646848168, "uuid": "2510b9a2-0581-47c2-8800-8d9e903bcb29", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646848168, "uuid": "e6a64742-bfce-4200-9677-4024cbc45cec", "value": "42c46547253d76fd0c0483b0a9ab7f01", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }