{ "Event": { "published": true, "date": "2022-07-21", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2022-07-21", "timestamp": 1658448181, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "4453b790-5b1e-4dc5-9889-de254eaebf2a", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df3dafb3-08ee-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1658405755, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658405755, "uuid": "08ac51c6-38a7-4822-a5cc-e57015bb5701", "comment": "Malware payload", "value": "fe26dace4fca32363deac500a4ea4762", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658405755, "uuid": "e3c64253-f13f-400b-8c84-aa0a3db28176", "comment": "Malware payload", "value": "0054134803c5c713ff10c253051ea036560ffa6729ae4a1398c9cdf5470cbc2f", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658405755, "uuid": "d1512e85-b96c-470d-bcf4-12ce2b911dcd", "comment": "Malware payload", "value": "807ceec2d38373cd97d74add596b9a975a9a3e88", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658405755, "uuid": "91132807-07da-479f-a2ca-b731e934f55a", "comment": "Malware payload", "value": "25a2f5e7cc0792ebe1503f031c69c18a0da2e179527f17f82257ca947136c0e1e277145b67cd1daa892736139904f592", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658405755, "uuid": "39ab76ba-26a8-466c-b885-129f70fa4772", "value": "T103C2E03D160104A6DA76CA7BB25403616C304F6AB182CE057E45C973DABB270FDBBB95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658405755, "uuid": "609766da-c0f7-4bdc-86ed-c4154c4f71af", "value": "768:My9xnKngAVraqVAn+decBr1nJgGlzDpUYshw:My9Un5EXn+vr1lVqY+w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658405755, "uuid": "0fa97cff-93ce-43da-a5e9-e469e27121d4", "value": 27896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658405755, "uuid": "5156729f-1c35-4600-9d91-3a9de88cd70c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658405755, "uuid": "74549d12-cab3-4a70-98a7-b0ac270921a5", "value": "yakuza.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e49d260d-08e6-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1658402328, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658402328, "uuid": "e46a5c1d-8e8e-4546-9c11-cf8a48147bc0", "comment": "Malware payload", "value": "5d5358fe743bf26ad36db079bdcaac8b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658402328, "uuid": "f38c4dab-a6bf-4bf1-909f-185535557337", "comment": "Malware payload", "value": "010103b7bc0821e3a051a03cdb34a3165a75b583663e4524894b175b71043cd4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658402328, "uuid": "90a2a439-d640-457b-9837-ef779ab9f2b0", "comment": "Malware payload", "value": "47af4a7baad2017ddf2bba9c3105999a4fc48752", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658402328, "uuid": "9556f67c-e69c-4a2b-89b8-e3323576b5b8", "comment": "Malware payload", "value": "9ee36923f804caf157b1922c544730cb23521f80ab0cde2a8aaba9551dec1af19368d5b7628f0c8f48325a00da226da2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658402328, "uuid": "dcecd13f-4c0f-4284-9c96-4d2d8b146795", "value": "T1C6522A2167E88AFEEBEB4B745E7A430447326B405B27CE3F9D85804ECD767809501BA1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658402328, "uuid": "ed17ae16-16f8-42d0-b0e1-aef35cf98fc3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658402328, "uuid": "4665773e-a8e8-4a84-81e1-75db3c45c36e", "value": "192:x8ZaM+S84rtBFoPEyNPf0X/u/RE89b8tT7FBzu0gHMuFkjLYbw:9rN4rjFchNPMG/RB9b8PBasjLY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658402328, "uuid": "c6aa214e-ea91-4f3d-aa92-b07b57eb3ab3", "value": 13312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658402328, "uuid": "03706570-8454-440a-a4bf-efea349088ef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658402328, "uuid": "3452cb8c-d13a-4834-b1f0-504651c6c051", "value": "5d5358fe743bf26ad36db079bdcaac8b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35f6d84a-08fb-11ed-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1658411055, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658411055, "uuid": "d068f671-ad09-4c79-9806-ac3cbc7d152d", "comment": "Malware payload (AgentTesla)", "value": "e5fba8303519b980806150488b669b80", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658411055, "uuid": "e4c9357a-ead7-46f3-a258-2a3ef820c640", "comment": "Malware payload (AgentTesla)", "value": "011bdb01c6863489c07befe11070e58a2a5b0feffd8be81ae06cc972db783d8a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658411055, "uuid": "c902228d-faf5-4b98-b020-5645192ee437", "comment": "Malware payload (AgentTesla)", "value": "d0a359c31eaff99ecafbb94596a3bf7b773e9b11", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658411055, "uuid": "960b9dfd-2c5a-444c-ac0a-08a6efbddf25", "comment": "Malware payload (AgentTesla)", "value": "16ac8fcdc5138db13ce6ec99f302c63c5dfc376a8d1715e143871d95d467be829eabb522b70103bd76dcf585b7c09f3a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658411055, "uuid": "6e6da427-ead1-47e5-b0c6-2e79b9ee2dc1", "value": "T1F015123761E4B612C93897F31163AA880BF7701CB071F25E24AEA8E694E57C56B107F7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658411055, "uuid": "14b156c1-5f02-4326-9632-84d68646c7eb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658411055, "uuid": "5462bfcd-9f58-41d7-9a60-d8ad02c8f06d", "value": "24576:i0udcIPPafM2vCmh98d7fi0RQw9sr8q7RMfFxr:iVcIPCfM2Kg9y7aGQKsr8GSFl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658411055, "uuid": "1547bb5c-2bc9-4822-b4dc-ab146556ecab", "value": 893440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658411055, "uuid": "26fb4d6a-e883-4e8a-b15b-75b6536464c7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658411055, "uuid": "da34568b-12d9-438f-82ea-06cf195baff8", "value": "Payment details.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b87f5aa-0895-11ed-93bb-42010a9c0043", "comment": "Malware payload (njrat)", "timestamp": 1658367336, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658367336, "uuid": "e6094150-5e7d-4e8c-a287-86f174837a8a", "comment": "Malware payload (njrat)", "value": "b23c68b9fa10f007ceb6e2b996fb3182", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658367336, "uuid": "33f872c3-9d84-4363-85b0-9d2a55ddff78", "comment": "Malware payload (njrat)", "value": "02384895e3cc26b4844744ad987dcbad59a24f03053a5f4f82af768767aac548", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658367336, "uuid": "0c4c582e-c39d-4c97-b478-4f46b5989e92", "comment": "Malware payload (njrat)", "value": "70e866a76c08db151d5c42da8076e2af7c485b1c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658367336, "uuid": "5e170559-b05a-4acc-8b7e-8b0d29c51a59", "comment": "Malware payload (njrat)", "value": "9b371ceb258b96d79611a20e12a9bc423818a9e5283dc6c8803b1c5967ad50ddbceb7d16a29d303531c65d52d5328752", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658367336, "uuid": "03762ec4-3610-4d97-a33b-1f2aa3605c65", "value": "T1B654CF6335D1C032D41354309ADA9BB2A6B8B63527B5658BFF890F2D3B716B2C31A743", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658367336, "uuid": "5f3a31e1-6b4c-4850-a679-fe9925e21a89", "value": "4cfda23baf1e2e983ddfeca47a5c755a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658367336, "uuid": "a9781296-2740-44ba-8b4d-f7e1c9768047", "value": "6144:wsxanyfX5k7JlJDlABKUtfU/WQcb5Z8zE243ZcfN/FppwPLZOIstIpP:N0nyfXuIBDtfuJumHhlWpP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658367336, "uuid": "cd1ae62b-bbba-405a-b3c5-39571b93702e", "value": 303258, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658367336, "uuid": "989886af-36e7-4215-8dce-8139ff75719a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658367336, "uuid": "6a1a8d7f-e5e6-49a0-8f98-c22eeec3cbfd", "value": "b23c68b9fa10f007ceb6e2b996fb3182.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d076360d-08c0-11ed-93bb-42010a9c0043", "comment": "Malware payload (XFilesStealer)", "timestamp": 1658385974, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658385974, "uuid": "e0516d68-59a8-4f73-8bf2-5e65e7a60cc8", "comment": "Malware payload (XFilesStealer)", "value": "ef060415090b4c1f3759c58d3cb1ed48", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XFilesStealer", "colour": "#D1E15B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658385974, "uuid": "e128fe18-a2ca-4031-be05-20b8b1c37671", "comment": "Malware payload (XFilesStealer)", "value": "030b845ceef6ad578d8209e51657c1e901b482338f9b510bc8516fce1acdea7e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XFilesStealer", "colour": "#D1E15B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658385974, "uuid": "dadadaa6-1350-4823-b217-f72b9e602a6c", "comment": "Malware payload (XFilesStealer)", "value": "ba068f958db6e8e24fee025482346f9568b9e615", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XFilesStealer", "colour": "#D1E15B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658385974, "uuid": "921e9350-19b7-474c-860b-5a7f79d0103e", "comment": "Malware payload (XFilesStealer)", "value": "a27cf5e360b21e7fec846146e9d76376116a1d0b0c908caf5e68613fc6e560b57206df5c5c6269c440fbddc3a5cdf06e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XFilesStealer", "colour": "#D1E15B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658385974, "uuid": "4fb5c36b-bc03-4b39-b197-ee0d221f3224", "value": "T1A346236672A3D5A9E0C04C7AEA0A71FAE9C33E79DCE395D32570BF2A317E121910D153", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658385974, "uuid": "f3df5124-e48e-46c0-a6a3-6f9a1ad4535c", "value": "98304:ylOgqc/GyFPd0r20TxTTyEFBV4LYh4aybnysf/RCOsbYz5Ic0Ifh:T3c/5FPd060FTlVkYhVybys35l0I5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658385974, "uuid": "19c28fed-14c9-47e9-be78-5a16f7362098", "value": 5540352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658385974, "uuid": "12d04d8f-03e3-4f68-a871-420be5406f20", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658385974, "uuid": "8d6e7548-8b54-40fe-a373-e333b957736d", "value": "ef060415090b4c1f3759c58d3cb1ed48", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f88fdc90-0928-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1658430709, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658430709, "uuid": "f9d96d62-5d10-4926-b09e-ece04e3719bf", "comment": "Malware payload (Mirai)", "value": "567d0823715cb78746de160ce0e4bbac", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658430709, "uuid": "a1ceba31-c11a-49aa-9df1-bc22fb6856b9", "comment": "Malware payload (Mirai)", "value": "0458ce63c302188f752f112e9b28278eb84fc1c4f2e85c77038b723dae5b1cf3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658430709, "uuid": "464a5aac-92e2-4418-afd2-e73f0bf7a7f3", "comment": "Malware payload (Mirai)", "value": "ed7077057032083e1c48bc5e42f6b602f02f2522", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658430709, "uuid": "99585c05-9c08-4a64-a0fa-ac592824b971", "comment": "Malware payload (Mirai)", "value": "399e4c074febd7f24db1ae96fa7581d8c6873b9765f1aae14cb7c4a1caeedc9ad26148390e2024a5b8c97a1f004b1b17", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658430709, "uuid": "d16db08b-ced3-40b2-a285-12385ae6364e", "value": "T1A6C2D07418007970D3700639FBADCA876BABD1F481F831561A5016FE564B586B8BB78F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658430709, "uuid": "df545b9a-398b-4d8d-bef6-c9b5391bde15", "value": "768:xRSa8ZS/L6rze3OXrFKg9KZrqoDudfks3UozY+:vSjFJXZBCJDudJzx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658430709, "uuid": "16e59baf-dd79-4250-a905-4fe15df33247", "value": 26292, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658430709, "uuid": "2f7ec3f9-22ec-47f6-b07d-c05bddfce4c7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658430709, "uuid": "4f8fd5bb-4c3d-446e-bcb5-9ca6b6669f92", "value": "567d0823715cb78746de160ce0e4bbac", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7304a33-08b5-11ed-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1658381261, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658381261, "uuid": "e3fefbcc-318f-49df-ac4b-a8c3228a683c", "comment": "Malware payload (AgentTesla)", "value": "ca391f3a3366cf220d17afbbefe8c3b3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658381261, "uuid": "138328db-161f-4119-a63b-6a06d4cadabc", "comment": "Malware payload (AgentTesla)", "value": "05c145b6410525b3e099f43e8343f5e231afc4281aa95f10223b1598ad8c175b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658381261, "uuid": "5b5e1240-300c-42c9-a43d-5e9c156e946c", "comment": "Malware payload (AgentTesla)", "value": "52af4582f66a392b9d0a5a078bccce06304c33da", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658381261, "uuid": "5416d0c1-1352-4a45-b72c-b7d1ae0e2931", "comment": "Malware payload (AgentTesla)", "value": "0dedad090bb8a6153284ca5c95c27618be781d1be96bc603c495c2ae66ae985ef27bb467d648322b256ae786589200b2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658381261, "uuid": "c3a7372a-1de6-432b-9e56-bae4db53fb97", "value": "T11BC4E054F6C6C22DF4FBCB7C0BF4A43577F5E5129605E4BA2EA01E8E0662FC88542972", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658381261, "uuid": "0e5ca1ad-4fee-4fdd-a010-82f0ee3311d5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658381261, "uuid": "37085778-8abc-4e7a-8873-c9b2a3a19281", "value": "12288:1ODP0uqT2iNJlTzB2+QbvXOwP3Av5DB++3Ux8gCQo4:M4T1N4+QjXTO4+kxs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658381261, "uuid": "915ac7bc-a9b8-4c28-b6a0-8063591ecc00", "value": 579584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658381261, "uuid": "8a8bec3a-3b1c-486a-b159-7f21d0a28e19", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658381261, "uuid": "774c60fc-bfff-4a4f-917a-981fbdc5b5a6", "value": "shipping documents.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a72f8cf-0923-11ed-93bb-42010a9c0043", "comment": "Malware payload (IcedID)", "timestamp": 1658428376, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658428376, "uuid": "5a514d93-e903-4cd7-a422-8b532fb2fa57", "comment": "Malware payload (IcedID)", "value": "b852d10715d7e4ba0667415b9357158e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658428376, "uuid": "42920afe-172a-41fa-acb9-397838de6291", "comment": "Malware payload (IcedID)", "value": "0697c41be498a7c8cc76a487fe99e3327096626bf806854f450fcfaf178afcfe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658428376, "uuid": "73a5dc4d-d218-4b53-abcd-59963bac2fc6", "comment": "Malware payload (IcedID)", "value": "495559e62cbac47e916b473589a6aba24da4594e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658428376, "uuid": "da3174fc-e7a2-4809-83ae-f8f470846320", "comment": "Malware payload (IcedID)", "value": "40ea1588fdefbd57fda8d53fe7c419d8e30b70d94b5326419f23f06ee2d5786ae42a530f77ad4e94797550b2a9d11e1b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658428376, "uuid": "6d8e2146-3307-4e71-8bc5-38874b857826", "value": "T18104187266C55056C22291F3D920BB4CFDA3D43BEE4A8D82B3BC1AFE1BD1D50E523A15", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658428376, "uuid": "ad603fb7-1519-4dd3-99ef-5728cab6f29f", "value": "3072:08s75HoCqDhCzPfEn9XWR8iIGqlZmJRsGL:KoCqDhCUiIVMR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658428376, "uuid": "de08e1a5-e4f3-463e-a406-c7f8339e8f23", "value": 181248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658428376, "uuid": "2fc6991f-941d-48a0-a084-68a86129cd34", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658428376, "uuid": "23bdc513-258c-4b2f-bd4b-9736b1ec976b", "value": "ak3pn.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12044dce-088b-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1658362891, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658362891, "uuid": "004c1f9d-9c97-4616-bad1-61594b0c4f9b", "comment": "Malware payload (Mirai)", "value": "b93443861956746a3cc10e9240c260a4", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658362891, "uuid": "d2eb544c-e0c4-4e72-91af-7cc584922c52", "comment": "Malware payload (Mirai)", "value": "06e98fb221253a8a7cddbc7bbf2f667f8cae4954cebcae49d515a804de11aced", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658362891, "uuid": "939ef2fb-5040-4e67-a838-80e81a9ccd29", "comment": "Malware payload (Mirai)", "value": "e049f79d67919df0cea5a7a8292ccf7a730281bc", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658362891, "uuid": "caff2d45-e2c5-4acd-879f-3f7ae1144a34", "comment": "Malware payload (Mirai)", "value": "3628c57a25ca112387a7367e7781abddf148097042465a626277ef7b38de06b8fc04acc7b6cc64919bc056a42021d907", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658362891, "uuid": "49a5cfd3-f8cc-4a1f-98de-816ab45f3ac0", "value": "T15EB2D070557B50B288F50CBBCCFECD4EAA141F7CE06A7112B66D476C86A14D06AFA153", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658362891, "uuid": "69f7afcc-56ec-4212-b1ea-d58a5cc8769f", "value": "768:Gn47wmVkIEBaE9YMGTBkJc+rGR2hCww3U+L:s47ZEwEU+yxR2QwcL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658362891, "uuid": "55f45cd4-d9f5-4509-bfb0-89ca056fec60", "value": 25344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658362891, "uuid": "351b49bc-ea36-4bac-b0fc-0d21d015c349", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658362891, "uuid": "e5e89cc8-3bb1-4548-a3d4-9781429d0952", "value": "yakuza.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e085594f-08ee-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1658405758, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658405758, "uuid": "fa3629f8-aca3-49f4-a745-fb16fee9fa80", "comment": "Malware payload (Mirai)", "value": "3073c51bdf5ab45f33bb4bdd4aec40d4", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658405758, "uuid": "350dcd7d-daa9-4805-be45-43b93f70de86", "comment": "Malware payload (Mirai)", "value": "0703cc9e6667ddc1e7967320d9fc2b3006b36e57220ad1352cb463287938fae9", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658405758, "uuid": "e1b80393-3ff9-49ef-be33-c4005ab74473", "comment": "Malware payload (Mirai)", "value": "f0ec60a66f136a27b99e1b32ef8bee7e621713ee", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658405758, "uuid": "0ffb1924-b005-4470-a734-d0f21343092c", "comment": "Malware payload (Mirai)", "value": "c7aeb0654e3e9db91aee0b35bddb05494bf950b9d4b6866add25d47a8222f45a690bf2486010d53b6f329d2c7b405a2f", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658405758, "uuid": "5c413258-15e3-4cca-83bd-b28a39be7570", "value": "T14ED2E1B02B65D8E2C2F00A35E87FC343B65D2DE854E53036A6D76F146EC6CDA64F8012", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658405758, "uuid": "014b57ae-65eb-42ef-a3fb-644a349b0339", "value": "768:p75e0qREETPkkYlIztMs7X2WK7B+1Kceq3UIKf:pFRg8yCsNfsyQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658405758, "uuid": "42731970-f2e0-4a31-bb81-d7a2ea731cf3", "value": 29828, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658405758, "uuid": "7954ba63-ca6c-44b2-bc6f-d7d66d74ed63", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658405758, "uuid": "47d5a739-955f-4ef3-80f1-59e5ac90aa1a", "value": "yakuza.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6546ae6c-092c-11ed-93bb-42010a9c0043", "comment": "Malware payload (Amadey)", "timestamp": 1658432180, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658432180, "uuid": "907f4828-1dc8-4356-9f97-4e086eb063dd", "comment": "Malware payload (Amadey)", "value": "6c5ababba60e08c0d1aa0da4a7e5795d", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658432180, "uuid": "72a6345f-d3cf-46c0-99ed-b5123704785e", "comment": "Malware payload (Amadey)", "value": "07ca3829953127498f2486ef71b9176f496a330f153f275969bb337824ba6ebd", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658432180, "uuid": "45c4f32d-6a7e-4dd6-820d-2878e6482e46", "comment": "Malware payload (Amadey)", "value": "b1858bdd3ec9e7cbb8ca9734216c793ee3aa49d2", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658432180, "uuid": "0024d3f6-e1e8-4dff-8ad5-fefc751e809e", "comment": "Malware payload (Amadey)", "value": "a77b5191234f38f23c75ef248814e2d7082e20a627e91601f09e9530e791123aa82ff1d9363e204789e1fb9714bcdb0a", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658432180, "uuid": "882e0440-cfb6-474e-8a9f-62abc6b5f789", "value": "T1B514BE3076E0C072D0A31E309471C6B5EA7B7CB29778958B37643B2E2E723D12AB5756", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658432180, "uuid": "1987ae73-21d6-4dfc-9ff1-1d9886118bac", "value": "401da744a568f91ec17ba84225e05b40", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658432180, "uuid": "f3312e2d-4c8d-470d-b996-55594a960dfd", "value": "3072:MGGWy9LsTmwvxfgZo5SUIsJVcZ2mJhPM8KuBcZ84snvGKhZBa:VGbVLKiUSUpJVYLPjHBcZzovPb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658432180, "uuid": "7aad821a-588c-4317-9a63-731e70dc4933", "value": 196608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658432180, "uuid": "8384dcd0-285d-4c74-bd10-5e0c303b6565", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658432180, "uuid": "4af1a435-a6cc-429a-8d59-50bab8ca9ba1", "value": "6c5ababba60e08c0d1aa0da4a7e5795d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a5257da-08f9-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1658410284, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658410284, "uuid": "2c5033d3-b869-43c7-b9a6-f102c2e610cf", "comment": "Malware payload", "value": "ad3f78998715d09c57611278517dfd41", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658410284, "uuid": "4b6d4b6d-d837-43eb-b4e0-36b27ce77329", "comment": "Malware payload", "value": "09c5e8a78b95da3ef8cf55a3883f2fa0b69e8d1c9447ee410f44b4c40df398be", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658410284, "uuid": "d0ab1889-e124-41d1-86ab-30d1ad2100d9", "comment": "Malware payload", "value": "ac50a006cbda23c2069697923f96718b7f4fcbf0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658410284, "uuid": "b6781678-cc62-488f-8b34-423afcc4b205", "comment": "Malware payload", "value": "bbcec49f3414002d9ebcefd80f811b161f1b3cf162a7e03b535cf0baef4b35b00c74c15dbad3817dbdab6e350a931a34", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658410284, "uuid": "5460b693-14e4-41f8-8d52-705c8e4eaf7a", "value": "T1E5A47C96F2B540BDD0AFC5B5CA12961BEBB2784A1234E74B52E0CBF61F13B71661E310", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658410284, "uuid": "a2750760-3965-41b7-addf-5b05a1fab6e8", "value": "12288:S5WvIcqgICTR6RB2JiIoHxXmwN8kLR3R0:aWwcRICTkBIoR2wT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658410284, "uuid": "3a54892c-8c71-4e79-9346-fcb8455fcba5", "value": 469504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658410284, "uuid": "a4983caa-cef8-4002-ac7e-894760a4a603", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658410284, "uuid": "7cf4d2eb-0c14-49a2-9807-cbcd1d35e6c4", "value": "10420000.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b753eaa-08f9-11ed-93bb-42010a9c0043", "comment": "Malware payload (Gozi)", "timestamp": 1658410286, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658410286, "uuid": "c14164ab-f670-460c-8115-e330031769a5", "comment": "Malware payload (Gozi)", "value": "18f49b03aff4cb324b70f341fe2c66a9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658410286, "uuid": "2a601982-6a5f-4661-a5fa-e80b21489280", "comment": "Malware payload (Gozi)", "value": "09d369033213c0ea4ce1d9172437482aa9ddc30d2854c8c7ab59122d8711315a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658410286, "uuid": "0d5c50ca-dd19-4f9e-a935-01d8ba31782d", "comment": "Malware payload (Gozi)", "value": "afc777a4891bc368a8e4b2e45271c5938c98d83e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658410286, "uuid": "f75320a7-0b53-4629-bdbd-fcb51730b998", "comment": "Malware payload (Gozi)", "value": "d08e7ea536f862858383cd7ecd78c5dc5ec67cb7d8921d718d87ed2ca74186dfe0900670ddc5063a804458605d9c2766", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658410286, "uuid": "07908c3d-13c9-469c-b3ee-c1e097084e34", "value": "T16FA47C96F2A540BDD06FC6B5CE12961BEBF1784A1234E74B52E0CBB61F13B71A61E310", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658410286, "uuid": "5431eb91-2b4f-47c3-97d4-6976a2f0e97f", "value": "12288:2NxqVcFfI6gT1JsIwzAd3gZrLyI3hLRoOszhP:GIcFQ6gTfwwgZXy9Zp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658410286, "uuid": "dd923afd-7dca-4192-8460-6908c2078713", "value": 467456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658410286, "uuid": "343fa469-eb4b-4496-88ca-c0a4b1583600", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658410286, "uuid": "c5c4d65f-41b6-4447-9047-15ea535f2488", "value": "10560000.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f982f56-08f1-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1658406883, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658406883, "uuid": "8ad0c384-9506-4b11-a031-1e710b45a86c", "comment": "Malware payload (Mirai)", "value": "df04a489e4a9720f0258a79b4b3d8d76", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658406883, "uuid": "018a2687-a021-4991-8956-e198c0f38689", "comment": "Malware payload (Mirai)", "value": "09eba013129966f730fe29a7e9cc303e6b43fdb258d4bebff226b80d46455fbd", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658406883, "uuid": "51e91483-a3fb-4dff-bb35-0585544c7840", "comment": "Malware payload (Mirai)", "value": "a50057d77c72c2da6d315d948ffa4dfc62a54095", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658406883, "uuid": "12f9845a-0daa-48b5-8706-577ef589e044", "comment": "Malware payload (Mirai)", "value": "a7d29cf25f69ed19251029a6dc11955b13c77ab7615fee3af28b82e4808156170e1347d1ab27c8f109783a39ed4cb55a", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658406883, "uuid": "d85e7c53-a55f-4d5c-9274-f2269e501da6", "value": "T1DEF2E16E73CB421AC6E650726DCE2B9CC000634B0AE4C2EB67FC351675E5E15ABBC592", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658406883, "uuid": "b337fdf2-9fbc-477c-8474-d6bb964bfd93", "value": "768:gHZhibKCRurBa706ku8C2yiNvu5aUdr5KTF1xSnbcuyD7UtQRjJ:3Rum0errSG5Fdl6F10nouy8ty9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658406883, "uuid": "69a78b72-9928-4070-b475-b241d5cf41cc", "value": 36408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658406883, "uuid": "8b360cf0-2cf8-4839-a7d7-95db395a0b0f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658406883, "uuid": "7816d6a1-f913-49e3-a999-d3b166be50df", "value": "home.x86-20220721-1234", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fdb49a3-0896-11ed-93bb-42010a9c0043", "comment": "Malware payload (RedLineStealer)", "timestamp": 1658367612, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658367612, "uuid": "9b67f34f-74a2-4860-8a9a-0da4ad096826", "comment": "Malware payload (RedLineStealer)", "value": "a560eef0923ad29df6274b72fc6769ac", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658367612, "uuid": "02865e83-118b-4a6d-905a-d35f93e5aa98", "comment": "Malware payload (RedLineStealer)", "value": "0bf3150a1835e767f1f1ea33e79847a76b7d2ef906add5f3e3777d935f608a52", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658367612, "uuid": "7b5b94d5-6d8c-4a77-8dd4-2c02c86fe7f2", "comment": "Malware payload (RedLineStealer)", "value": "c1267082a475a44df53be5f597b339d29675109a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658367612, "uuid": "4bd895da-97d0-4697-abef-1fc5f2687c7f", "comment": "Malware payload (RedLineStealer)", "value": "d74baaa6992d6f016c6772f9328f8074729abf5cc068e2138300f4a2b288986bb48e2a3d347c6d7efe29301b2433edf1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658367612, "uuid": "dde91ceb-c134-496f-8aba-3ed1d84c3d8d", "value": "T14294BF10BB50C035F5F712F48AB68668B93E7EB09B6450CF62D56AEE5634AE0EC31347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658367612, "uuid": "5dd90ced-5e9d-4add-87b2-ef42c14e79f6", "value": "66bf435feaaa12e148aa302420048fbf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658367612, "uuid": "5da9ff3f-12c7-492b-a709-91b41ece4451", "value": "6144:Gx5gAiwHL6kY9IO+jMqtlQ28vcGQsZaiwFuX+dBz/EkL4zCcL9te2A8DOW5xQSS:wgAvutyX4qtlQ28E+aiwF9/z4+wBd4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658367612, "uuid": "439c21b7-b7ba-40c5-a588-7c79d8b6e983", "value": 435712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658367612, "uuid": "69b3f22f-a789-4279-a871-3109ce0ae011", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658367612, "uuid": "344e32ff-3d2e-44a6-bd52-0c6112a25bb4", "value": "a560eef0923ad29df6274b72fc6769ac.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "703a1983-08df-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1658399127, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658399127, "uuid": "f396925f-3c74-4702-8f00-defbf2ab9f5c", "comment": "Malware payload (Mirai)", "value": "1fe7c6e59372147b2c1f08614170aba6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658399127, "uuid": "68c28a3a-2c52-4b75-aff0-887b5d8a7d58", "comment": "Malware payload (Mirai)", "value": "0c187800b1223378c50fdcf00fc52fadae635b139649e34a7a7535f642e25b8a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658399127, "uuid": "662c00d3-1a27-444f-91a0-52daf8576a7b", "comment": "Malware payload (Mirai)", "value": "e032003f02334ba77c1d8ebea8e4572a37852c57", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658399127, "uuid": "7fcb26d2-2103-449c-8e5e-cfdd15e7c246", "comment": "Malware payload (Mirai)", "value": "a36fad591c80f2134025a30ac058c7c17ab5b92dee954d0efdd444854932a772376f7dda5d9dd20bb3e227bbad360d90", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658399127, "uuid": "cb23e2de-0efb-4580-8fa1-4f3b820c22e4", "value": "T178331959F8814F22C5C5027AF96D128E372357E8E3DFB2136E206F607BC692B0E26D55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658399127, "uuid": "cd826c37-6cb1-46b6-9b9c-2b8b9ade3bbb", "value": "1536:U9CnHIxuIb+aJpEaviGjzn1SI8iiuXgv+jT:euaH3TkuXgv+j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658399127, "uuid": "2bbd1434-ee1d-4b65-8597-99546cab824f", "value": 50808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658399127, "uuid": "7618f642-2069-4c09-8391-be19b51f503b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658399127, "uuid": "1f475759-9ad2-438e-9f87-2027c24115b1", "value": "1fe7c6e59372147b2c1f08614170aba6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ca7e418-08be-11ed-93bb-42010a9c0043", "comment": "Malware payload (AsyncRAT)", "timestamp": 1658385028, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658385028, "uuid": "08d7dc33-db91-4ad9-85f3-d45bbef921cc", "comment": "Malware payload (AsyncRAT)", "value": "4cc7d2e89502dc10ad93b0c1dc6dd872", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658385028, "uuid": "1de874f3-9876-4e76-8f72-8f7f8b6be61f", "comment": "Malware payload (AsyncRAT)", "value": "0c3d87b5d21c93af3385c2fa391d93823ec3990ebb13e58c01ee6fbfb02e5a71", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658385028, "uuid": "8faa5720-45f5-425e-bfd2-cf4c0839e412", "comment": "Malware payload (AsyncRAT)", "value": "a9c38b345b788a278c56f062e93c7328be8e54a5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658385028, "uuid": "ad7473ef-1420-4b01-b3bb-3307590e96e0", "comment": "Malware payload (AsyncRAT)", "value": "84c445a6114622cf231845f40a4aa41ee1f2f91a7747e443965a88f760783b5b75b766fd54e2762a76eb188c330a32fb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658385028, "uuid": "bb188efe-c0a8-4889-8b53-b6d4a834e540", "value": "T1CFD4B56A62B1D178D4C08C7AE60AF5FDFD826D39D8239D132540BEEF33FA161561A072", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658385028, "uuid": "17979a93-20e3-4f65-a476-c876b9d628e5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658385028, "uuid": "79146af6-7dcd-41d3-ae3d-e7364cda2fc8", "value": "6144:khMzkWBCyfn1ZaQckrUQsVaeUXqOhxO8vPQYUH8+:0uCyv3cjQYUXqOdHQYUH8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658385028, "uuid": "70450d1a-5245-4bd6-844c-9a89c6505948", "value": 611840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658385028, "uuid": "5bf0620d-f5a3-4869-9e63-3244307d35fc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658385028, "uuid": "631c04d0-01da-428d-bc05-12e7d5186d21", "value": "4cc7d2e89502dc10ad93b0c1dc6dd872", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07a441be-0932-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1658434599, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658434599, "uuid": "d28c37e4-9688-44ff-aef2-580aa18ee549", "comment": "Malware payload", "value": "1d03b011fc9a5cfd5edf9a375426ae09", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658434599, "uuid": "435037dd-f3bd-4cea-a681-44bddb7fd3bb", "comment": "Malware payload", "value": "0c84535c8450f598803d43aa915ed09b0566b7a2dc7a7b4b50b6f0a6799713a1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658434599, "uuid": "1365da0f-28ae-486d-af2e-ebbc03d6952f", "comment": "Malware payload", "value": "9dc412793026f8fa9e54df7df7de3c72c4b98a33", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658434599, "uuid": "d831c9e7-ec02-4b96-9e10-b069c0314e58", "comment": "Malware payload", "value": "94e3e693b328fbb1897fcde918952c760f5ccb94aa04b6b2bca617d67d37c419161849d74f94598ec63d2b0b6f4d4e31", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658434599, "uuid": "4acb65dc-68be-42ea-b3dc-5aa77a590b94", "value": "T143C32905E5518757C2D2177AFB8F425D37332BA893DB33125A34ABB42FC27991E3A920", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658434599, "uuid": "58fe77d5-9b68-4155-8908-368f73364d7e", "value": "3072:RuQNaHnOmWt6Ou2/+BL4DD+45peWNbmGQOtDX7eb:RxNaHnOmWcBUDDYWNbmGQOtj7eb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658434599, "uuid": "de379eb6-d4d3-47bb-814b-a574207057ad", "value": 128556, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658434599, "uuid": "dfb72ba8-a1cb-4150-89e8-fa86acd67831", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658434599, "uuid": "2139f9f9-8f46-4eb4-84a6-44ebbd5b923c", "value": "1d03b011fc9a5cfd5edf9a375426ae09", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d537e7d8-08e8-11ed-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1658403162, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658403162, "uuid": "6b212f4a-fd00-4e8f-82d8-193964f9baf2", "comment": "Malware payload (AgentTesla)", "value": "8917ff83f563683690b57652529e9844", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658403162, "uuid": "c50f3b6f-67de-4bfd-9f4a-512779eeeece", "comment": "Malware payload (AgentTesla)", "value": "0cde08469c2b248c72f953933abf276955d0168b36c9959fd8b5d26967e5dca6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658403162, "uuid": "82d248bf-b795-4791-a993-819f21c3b070", "comment": "Malware payload (AgentTesla)", "value": "f5ee7b703194cf51959d57f87db2b3a13c356450", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658403162, "uuid": "8fc6be8a-b5e4-436d-8922-433d6e84a314", "comment": "Malware payload (AgentTesla)", "value": "a788d51218843b61d999ca2bb501275a84fa0e3a1db8ce9282152f94489f5f1f60ad78d92ce276446d68b99394edbffe", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658403162, "uuid": "e45fdc40-bd0e-44c5-bac0-b85dadda6cf5", "value": "T119C4D054F2C9C669E8FBC77C0BF4A47477F9FA128105F5792EA01D8E0622FC58A42936", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658403162, "uuid": "fb192c23-bc44-41e8-9af4-e1f19b5862fe", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658403162, "uuid": "8e976a54-4044-4fd0-856d-394a2acf143b", "value": "12288:XoP0uHT2iNQx8O8pAF/IN3ka4D5zAnmPTnNQkcBmY3CQo4:XO5T12xHyo/J58nUTwy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658403162, "uuid": "d83b5b19-4bc9-4149-9680-2748071272a8", "value": 577024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658403162, "uuid": "4467fbe0-cfa2-443e-ab3d-29c3a8f0c287", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658403162, "uuid": "a70318c7-9ce1-401e-b3bb-ee4caa45bf8a", "value": "MV ECOATLANTIC T&C xlsx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12516a78-08c8-11ed-93bb-42010a9c0043", "comment": "Malware payload (GuLoader)", "timestamp": 1658389091, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658389091, "uuid": "48715e44-3fd5-400f-9958-473cab7ae9e2", "comment": "Malware payload (GuLoader)", "value": "f41ca0094320f651139bb9385f22d857", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658389091, "uuid": "091b8199-5b4e-44f3-802f-2935d086dbfe", "comment": "Malware payload (GuLoader)", "value": "0d0e582ac01f247c0ef3925336d070d8c8e3d5bc730e8460fa935020eb088e7d", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658389091, "uuid": "3b484fb4-3975-4947-9895-7dc0c04d9952", "comment": "Malware payload (GuLoader)", "value": "ec435aaedaa7932818b16e09d862d8b9e30b67a1", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658389091, "uuid": "4417fe8e-398c-45fa-a4fa-ff77840bfd07", "comment": "Malware payload (GuLoader)", "value": "fbd2984ffb237fa35d1b09a0786f1aa8979d0a8134cc53a97640001ba5ef5f718b2a6d89d4868d3c927f8a0400722aa1", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658389091, "uuid": "2bff9c42-6417-416a-9f70-ce48b5e0460b", "value": "T177846E913322A5890EBD04A5796D876A0B502052B3D69771AB15C3F9D7A2037FB33F8F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658389091, "uuid": "8ba6b08e-66d7-41a7-a56b-1768d7220744", "value": "3072:vshz21nBsV2RT1/YsN8Ydb6DrBXTc2auSbsSuOl0Kq:vcz+6Vk6sN8YdOnBjgthSN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658389091, "uuid": "1441d1ed-1b3c-44d0-9939-903db9bd73d7", "value": 401839, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658389091, "uuid": "976b5678-c619-4ea3-976f-6a66da089d07", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658389091, "uuid": "e67fc8ec-ec3a-4822-b57d-c9d988369a1b", "value": "SKMDM_~0.VBS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b9ab06d-090c-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1658418312, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658418312, "uuid": "52549c56-c0ce-4cd6-9496-7d04ccd852b7", "comment": "Malware payload", "value": "020fe78d008822598577b50695d7a157", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658418312, "uuid": "e2dc712a-cd6f-4b86-8ff2-e4be4afd226c", "comment": "Malware payload", "value": "0d1655905267c7cbf3c6669e76be531bfa9731b8059482300c161b21ee143878", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658418312, "uuid": "1c845ff9-7c68-43dc-99ab-325abc05e61b", "comment": "Malware payload", "value": "7d95e979ffd6cdf0e6fcf0bef6a56db778f14192", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658418312, "uuid": "3c5b5e8e-2746-46fa-b906-707a8ab51641", "comment": "Malware payload", "value": "d35f33151fd1e4cc8cc2016bbb1fe35122f956411339586fa017016bad017e05b8b053efc5ff60a802095ee990b9a35a", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658418312, "uuid": "032a3783-f4f4-4821-8cc0-dcc67126d849", "value": "T16B3633E7C1712D5C8C790829150D6E9508902F3529019FF6ACEA2EBB937EDB1B1B1B4F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658418312, "uuid": "d45d380f-9233-448f-b054-b023bc545e28", "value": "98304:ooVfaSyi0/wJFdoiINsPiB4jQgpsZVvs7TJkDPxeR2zlanURln3dKGEZiTQ:DVKiiepMCjTpsLvsnqURWQnURl3aZiTQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658418312, "uuid": "fb1a1fcd-9727-4041-8a70-325c16d5da9d", "value": 5239570, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658418312, "uuid": "64e13508-87c4-4d1e-b230-3f04249ab4c3", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658418312, "uuid": "2088fd99-c276-4fc5-899e-e0b602b79014", "value": "Document-6DpPn2t0goH5.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "edb10567-08be-11ed-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1658385164, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658385164, "uuid": "addc4b7d-c9aa-4dcf-a363-f24c6b874584", "comment": "Malware payload (AgentTesla)", "value": "32499b1416d567c4ecfac59e288facd9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658385164, "uuid": "6662a032-5e84-4a5a-b839-efb4a1b8aa09", "comment": "Malware payload (AgentTesla)", "value": "0d2d7ec856520a42d891bc29ce7429e34ca8404dd6ca08bdd5b633560764e382", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658385164, "uuid": "a83af8b8-7be9-4b6c-a49e-ce0d4987d8e3", "comment": "Malware payload (AgentTesla)", "value": "dbe55af1869f5750d0d0f69e2c7e6bce73408b64", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658385164, "uuid": "535fc9f7-529e-45a7-a092-90dce23d74f4", "comment": "Malware payload (AgentTesla)", "value": "b21cb43cf6f9c378f0984dc874788aaa9bea9403d00248f4868094d936056ae5c1eac656a017eec4b512935716d2c3e3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658385164, "uuid": "c5ef77e8-54e8-4c76-9737-df7fbdf8586a", "value": "T1690548C8B1D4B4DED86BC1328FF83C64B651AC7A431A09275823759D4A3D987DF224BE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658385164, "uuid": "77c00c10-e9d6-48d5-8f91-a05c3e4cbe09", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658385164, "uuid": "e9d33888-0646-4122-a6a3-7684d1ca0441", "value": "12288:9qCV8f2vIVVxndmnGatVtaLQJExti20STumdtCCQo4zh3Mwzj12I2bNlVP1kCtJl:9zJIVVnLQuw/8lN/HYtmO4z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658385164, "uuid": "89a673ac-d368-47c1-87e8-30d420774ad8", "value": 869888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658385164, "uuid": "c6d4fe00-b4bb-477d-9cfd-f4ecd53a8702", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658385164, "uuid": "983c6c34-e30f-4818-8068-26779cdc251e", "value": "Details.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb6c3b43-08df-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1658399253, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658399253, "uuid": "1186ac87-aebc-4fa9-b3c1-ead779a1e306", "comment": "Malware payload (Mirai)", "value": "e1fc2a9df3ddf0fea69d9867e7e02da7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658399253, "uuid": "92e1cfea-37b2-4c2d-a6bb-0a4e170ca5e6", "comment": "Malware payload (Mirai)", "value": "0d782f3f6c9463c3b2a38bbc27ea2b52fe8aacb80135ebf4e871f02c5437e1c4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658399253, "uuid": "e3b736b3-4b2e-41d9-ba29-70b72a0db709", "comment": "Malware payload (Mirai)", "value": "fb5e2b6363afc0ecfa7268e2b2cfab1bb670c3e7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658399253, "uuid": "eaf4f971-38b4-4747-97fc-626eefda4e77", "comment": "Malware payload (Mirai)", "value": "9f604d260db1385cb40ca7f094f10c4cd56090c0a8b242385347afa3e4daccd72da8d3dd4d45a17935eb7dd53b9d470d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658399253, "uuid": "fc5ff474-f494-4fda-a6c4-9103bf3af4de", "value": "T144E24A75F01A9E14C1964134B8A89F352F13E0C8A3933EBB1BA641B5944BEADF509FF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658399253, "uuid": "4f36d378-6312-4770-a08a-48e01d71009d", "value": "768:Xa6ceaeHftt0LrNNlCXCdo3x3BLAcwT4:Xa7QUXlwp3nA9T4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658399253, "uuid": "07aee20c-a822-45e7-a24b-28f57c4c1fac", "value": 33784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658399253, "uuid": "17101187-397f-4ec4-baee-7a7cde8872ce", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658399253, "uuid": "72bd84cf-7e2f-4613-8a16-161dff4a71c0", "value": "e1fc2a9df3ddf0fea69d9867e7e02da7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "621e55f8-0902-11ed-93bb-42010a9c0043", "comment": "Malware payload (AsyncRAT)", "timestamp": 1658414135, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658414135, "uuid": "2442d24b-ce7a-485e-a4d5-6decc72f8b76", "comment": "Malware payload (AsyncRAT)", "value": "b94812f90a0b3afbdccfc245b1963b53", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658414135, "uuid": "ac97f246-2c3b-4068-b4b9-0c351b1537c5", "comment": "Malware payload (AsyncRAT)", "value": "0dd2a02ce7201eb07c7355e7e91367aa80b7551089752e59c826cd0abcb92773", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658414135, "uuid": "361c553d-abd3-48fd-aa6c-9e359209f181", "comment": "Malware payload (AsyncRAT)", "value": "2a924c4cdf31892df54705c2c9597518b82099c0", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658414135, "uuid": "5be19352-88c5-44cd-8d38-3adf1df9f572", "comment": "Malware payload (AsyncRAT)", "value": "92516aee563f42887f92c5767e7e60ae23eb888e34830ea90d593964684e3ce9f6cefc884a6732ce143ff625825da6ee", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658414135, "uuid": "5122ddcf-649e-419c-8888-1c59d3bbf51a", "value": "T155C3E12629EB109DF3A39FB15FC8F8FF88AAE573291E70B5214247064722E84DD52735", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658414135, "uuid": "137ff15d-b06c-476c-a14e-531791782410", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658414135, "uuid": "7d3dadd3-1c61-45f2-b028-e2ba93f38dde", "value": "1536:9u/i4fGXlGTpAJmP78mJ7E5QQ97c0kBZskvmSkYnGo6Zuf5:9QYm2c0bZux", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658414135, "uuid": "fd362223-0020-4217-9722-fd2ab91d376e", "value": 129536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658414135, "uuid": "5768d3bc-84c1-459b-8200-cc1286535633", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658414135, "uuid": "edece7df-6fa4-4b95-853f-d4c36d87c5c2", "value": "b94812f90a0b3afbdccfc245b1963b53.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6fbe18e4-08c9-11ed-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1658389677, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658389677, "uuid": "8fdaa902-92cf-4e77-beb4-e9ab57490bf9", "comment": "Malware payload (Formbook)", "value": "ca37ae796070f06e71a39c355f0f4575", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658389677, "uuid": "6685be72-f54b-4296-b2ce-df16bddaabae", "comment": "Malware payload (Formbook)", "value": "0e8425fd51b3a7dc0286a2a063179c5e3c42db14d950670c300646b3cf8e7beb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658389677, "uuid": "9f468522-f20d-488b-aa8f-8d3f53069891", "comment": "Malware payload (Formbook)", "value": "ebb910e1cc347b9adea8c0cc0156022f87dbee2e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658389677, "uuid": "1ba7a4f6-d7a1-4978-bffa-05a86331740b", "comment": "Malware payload (Formbook)", "value": "d2771647370eef8d89ee2b81c2917cc06836ff3fb5364388f4b79c6e78c6e560daefc578870db73767f58ab0f07396cc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658389677, "uuid": "bb0bdf02-1cf5-41d1-964b-15fe0529636d", "value": "T1DDC321827146DCDAD45328F2586ED57060B47ECF8165CA0D3B83BF2A94E734234A7B9E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658389677, "uuid": "7891d300-426f-47d7-a6f4-076a0a2260ad", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658389677, "uuid": "ab58b80c-a2b2-4f95-a376-2ccd8be7a360", "value": "3072:kM5d7hY72rOAOkGt6+duWA/t/SHUebbxCbGgKk12qk/9n/87gUHCzQgtn9LXCk9p:7G5FJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658389677, "uuid": "e530e34e-4e4a-4bac-82fa-2ed272539e6e", "value": 122368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658389677, "uuid": "aa79b5d1-1820-4739-ace1-e9bfe57ba6ea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658389677, "uuid": "41ddc32e-a793-49ae-85c2-14180cfd958f", "value": "SecuriteInfo.com.Variant.Strictor.274017.32598.890", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45beb07b-08c6-11ed-93bb-42010a9c0043", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1658388318, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658388318, "uuid": "3a5e76a6-3fc4-434b-9dbc-618372935134", "comment": "Malware payload (SnakeKeylogger)", "value": "c141e428fc16393dfde993c8bf3d0974", "object_relation": "md5", "Tag": [ { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658388318, "uuid": "83411d0f-39c6-4bca-81ee-40372c06b219", "comment": "Malware payload (SnakeKeylogger)", "value": "0e8838b848c384c6686ae092df781d5ec083b84a8132cbe4d4fc95ce0db641c0", "object_relation": "sha256", "Tag": [ { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658388318, "uuid": "0bd41916-b498-4d40-91fe-0d916274dad2", "comment": "Malware payload (SnakeKeylogger)", "value": "5450fe1e3d17eac15cdf144ac2114265f24e5660", "object_relation": "sha1", "Tag": [ { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658388318, "uuid": "5512c0bd-21a8-4ec2-a388-9be3c791534f", "comment": "Malware payload (SnakeKeylogger)", "value": "d0147c4065976c3bf212e0cba51dbb936ad96e1b447d69b85e4a3002ec6b80a35f23e234769986fa1f63dcec1c77a4ee", "object_relation": "sha3-384", "Tag": [ { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658388318, "uuid": "43055e88-a83f-403e-88fd-fd1e079dc803", "value": "T176F4237E63552F2E09B1F490D9FAD2C448153AE14D3BD6AEE9223FFC02148DAC6539D8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658388318, "uuid": "10b6ffcb-9996-4624-8189-47364b23d485", "value": "12288:jfngBLTeGPdp/PlBPooa13jIwurqWn+Kcw0bYFMK2DpIxjfHeZPPXG4LhSzfKVl2:jfniT7Vp3rAM5Rnbcw0dlDAT+ZPv7Qj9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658388318, "uuid": "ef579309-f6fb-4aa4-9962-763d66defc6d", "value": 749106, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658388318, "uuid": "3ad1f72c-7df5-4963-a0e8-a01ae3033d44", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658388318, "uuid": "4eb65342-9934-41cb-a5d8-8e69f0c47ada", "value": "detail lengkap transaksi.r00", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e27bc406-08ee-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1658405761, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658405761, "uuid": "ffd8b0c7-4e70-408e-80f0-b758ddb384a0", "comment": "Malware payload (Mirai)", "value": "f4f32263e5e284a964a57d7679a4a43b", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658405761, "uuid": "2cbb5610-5baf-400e-9792-ea265dc8c038", "comment": "Malware payload (Mirai)", "value": "0e967816762d6580538280302bff02a9e6aa932b3e2403c06d831874d5a2c662", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658405761, "uuid": "bb5b783d-cada-4985-aebb-bd4e93ab116b", "comment": "Malware payload (Mirai)", "value": "7f55dc221a11ab4349a7594cc9dc2b9dc57007c9", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658405761, "uuid": "9eb30428-ee07-4477-85e9-b894a17102b7", "comment": "Malware payload (Mirai)", "value": "521bab0db837f2bfa94ac32ee08943baea1098a0f8a02017dfabc6b84f8f586882458d0dbcabdd79c7c2b50979433f71", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658405761, "uuid": "969be78d-3437-4478-a356-b9b9ac074ec1", "value": "T12E92C030418E79F3CCB0083BEF54879A35DA232AA99325565F906779EE904D13EF918D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658405761, "uuid": "baf51006-b9fa-4d56-bb85-1d01e4b9a73d", "value": "384:PTZw6Nutbz8uAHV+TIgv1RhFKPo/ohh/FmdGU5ESV:bZwSGbzCVtgv/hoawht3UNV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658405761, "uuid": "6f87b59c-e1df-46cf-ae94-05a50769bf03", "value": 21132, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658405761, "uuid": "82a05ad6-6134-4d34-84ca-9feceb2074f6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658405761, "uuid": "fd1f3167-7614-4139-a15f-ff6896c4208e", "value": "yakuza.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d5012a0-092c-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1658432059, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658432059, "uuid": "18e97312-0e85-4314-b185-266b21899586", "comment": "Malware payload (Mirai)", "value": "b615af9cfd41c62980b2672845a9f15c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658432059, "uuid": "f180217f-9767-49df-b285-0964b0cbfd50", "comment": "Malware payload (Mirai)", "value": "0ec1e9b0918d9b728d107ac6b311cc39f5f866133583f78b07729d9b676df2fa", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658432059, "uuid": "834a9171-a300-44cb-a472-90e40992e291", "comment": "Malware payload (Mirai)", "value": "cba7b383342eb8c436f2ffe9db7ea9d14ac88d47", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658432059, "uuid": "619c0749-e3af-4eda-b2d0-5fd80a4ea4c1", "comment": "Malware payload (Mirai)", "value": "24e8e162509d4c74b5b30fd5391ececf9b69128fdab0eec421eb75f704705badffc01dac83159d8ea1de71b2fba131ff", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658432059, "uuid": "66dac231-b2e7-4939-bb2b-f490d220913e", "value": "T1B5C2D145D3102F8AFFDFACB99E2A91C03B2B175F574794A3B27852136562D1B6C01ACC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658432059, "uuid": "4c2516aa-1d1c-4e60-9002-df81da4fadba", "value": "768:BUbgeS1f8Dnz+AHyRas6JAshPVe4uVcqgw09M:BUbfaAQGAiNe4u+qgw09M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658432059, "uuid": "11db98d9-1f46-40bb-bc54-e5546a466f36", "value": 28280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658432059, "uuid": "d23d1888-4999-4ef3-95ef-833c70a8eefe", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658432059, "uuid": "410bb30e-7288-4ea1-b2a6-9f25ff120f68", "value": "b615af9cfd41c62980b2672845a9f15c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "945f9b93-08cf-11ed-93bb-42010a9c0043", "comment": "Malware payload (GuLoader)", "timestamp": 1658392315, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658392315, "uuid": "ef35d457-f148-4551-b002-1fc0bab9b6c2", "comment": "Malware payload (GuLoader)", "value": "e6cc210b399e8876b7fb8c45ec156eaa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658392315, "uuid": "8c13991f-43f4-4a7e-bfd1-fe07c8a075af", "comment": "Malware payload (GuLoader)", "value": "0faf5543b3fe80d01ba68547d5bf49813c8c93f9f942fdd46ecb684e47a93597", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658392315, "uuid": "e2115318-10cc-4b7a-89a1-a14e3d2aeef2", "comment": "Malware payload (GuLoader)", "value": "4b903bcb06db5cc849e58a0bd26f1d0a7311cdf2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658392315, "uuid": "46291864-c11e-409a-9ec4-30873bd3efda", "comment": "Malware payload (GuLoader)", "value": "904aab715c5d1e430c871b0dce40074ef99bb51a5a9e31ee6855bb492298a10bbdf8911c788f0dac801c190bc0abd747", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658392315, "uuid": "99baee5e-9059-4457-a705-e87f78c1db6d", "value": "T104F419655532B807C1C78A70F53082F29F606D9494F3889F26E1F74AED7FAB11A27887", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658392315, "uuid": "0de6f394-d541-4f87-ad76-8ae7cf822843", "value": "5f0c714c36e6cc016b3a1f4bc86559e4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658392315, "uuid": "53598eff-0f0e-4adf-953c-2804c9fbc627", "value": "6144:/1ssjoruNxdoWcofJfBjAxf3ioDwGecqrhZOWjiaR9p7n6+OTAQlAl826tFQt:GsMQEAf36tqOWjic7O82b264", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658392315, "uuid": "a3845f16-c568-4cd5-ab70-3082aa7697eb", "value": 734928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658392315, "uuid": "ff6bf50e-f227-4415-b3c7-b54df21f6b45", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658392315, "uuid": "9d03d9d9-1527-49aa-9ea3-0b902573ccd6", "value": "AEAT Notificaci\u00f3n.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6b4dca2-0948-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1658444449, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658444449, "uuid": "496680d0-fa5f-4ed9-b128-f61b22f9e636", "comment": "Malware payload", "value": "a33c4d3fba8f41c603643c17bf4c1104", "object_relation": "md5", "Tag": [ { "name": "CL", "colour": "#5EDEA7", "exportable": true, "hide_tag": false }, { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658444449, "uuid": "0b20b977-3199-4a2e-9781-6c44b34ae399", "comment": "Malware payload", "value": "0fcb3bd4aa20b61765531ec488976451373991acdbf0b55f7d640bb9fed1c82c", "object_relation": "sha256", "Tag": [ { "name": "CL", "colour": "#5EDEA7", "exportable": true, "hide_tag": false }, { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658444449, "uuid": "a39cfe6c-e9e9-4acb-a0b9-545fe3572fdd", "comment": "Malware payload", "value": "6b0bcbf5232c8b5ff40e88d87ba888c43e59af7e", "object_relation": "sha1", "Tag": [ { "name": "CL", "colour": "#5EDEA7", "exportable": true, "hide_tag": false }, { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658444449, "uuid": "482a2da4-4706-48cb-bf24-a168595744ee", "comment": "Malware payload", "value": "2b442cb47c03536214d0037292dc5f1bf032d579f26c6bdf0b7ffe5fb3d22a0691f8b045823886365c721c63356f0dd4", "object_relation": "sha3-384", "Tag": [ { "name": "CL", "colour": "#5EDEA7", "exportable": true, "hide_tag": false }, { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658444449, "uuid": "6ba1a658-64a1-439a-bdb3-9749a8eefc47", "value": "T1A425336C1D2C9695D53D36D492FF67923EAD2C2A9F2F7C309FA27A450C40260D2F94B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658444449, "uuid": "a57f2029-c585-496b-8e35-b724e7f5b5b2", "value": "24576:ni1gRPoL40dQa3JLqEnDMsLFvP8DC5YC+3jQ1P0tM1fXlU/aKZg:nFRO3RLrFX8HdUZiNZg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658444449, "uuid": "a85eb249-70cd-4ff3-812c-de5a29cf3d0c", "value": 1016782, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658444449, "uuid": "30a283c1-11c7-4ef6-8571-7eb091172f0b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658444449, "uuid": "88bf53ea-c467-4130-891b-b43c474112c0", "value": "00EUUUETEUURYTR2022.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3a6a6dd-08ec-11ed-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1658404796, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658404796, "uuid": "c82430d4-b941-4f3d-a14a-c37e3f2c2b73", "comment": "Malware payload (AgentTesla)", "value": "89e16697ce7b93befd01566fc16493c4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658404796, "uuid": "f32ce577-3889-4b5f-aeba-1b204b5bd64e", "comment": "Malware payload (AgentTesla)", "value": "100dbf5f7cae1bd81a5612d58c157dbe8c589745ddf3454ffb52dae5287552e0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658404796, "uuid": "766ca6e0-b8eb-4a5f-a45b-8bd1c0f38723", "comment": "Malware payload (AgentTesla)", "value": "f8c4d6ddc7504c0e88e261d4f44c9ec6c3d436f2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658404796, "uuid": "05ea8571-9609-43ed-893d-df933e785596", "comment": "Malware payload (AgentTesla)", "value": "c80d15d02d2d61ecf9bf88ec11b8cc7d37e9c2fa568b6236fadc1f81031c38f98bb8e17d1392a631276a2d56fa367af3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658404796, "uuid": "5d5303d5-ecc0-4318-987e-2aeaccfbab59", "value": "T1C9D4023376F7E911C53843B280D2124806F2630E7577E91E35DEBA5A85E23EA5E813E7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658404796, "uuid": "3c4a060a-73ed-4162-a517-4308d2ffb15d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658404796, "uuid": "9b5bb60c-9d62-4ea2-a4be-ea4245ff30d6", "value": "12288:y9Ggg31hbx823X5nc0SpxmlLb+BbYINeXaemnREoTSQDw:y98bxpZZuTNeXHmnREm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658404796, "uuid": "5342c2e2-4dcd-44e6-9318-38b961e55160", "value": 654848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658404796, "uuid": "7b0aad48-e774-4c82-ad40-e2f32c72f041", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658404796, "uuid": "cd44954b-95be-4ead-93fc-a046a6151ecf", "value": "TEKL\u0130F TALEP TUBITAK SAGE_xlsx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "170a3c7e-092c-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1658432048, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658432048, "uuid": "8a688498-42bd-4e5a-8247-a015041baddd", "comment": "Malware payload (Mirai)", "value": "8d4b1847020d4eb66948d9bf6af62c74", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658432048, "uuid": "2333acae-9a9b-4e50-9c7b-284cb35c66fe", "comment": "Malware payload (Mirai)", "value": "10c482c737ba5f59cb67a410d1889b55a0b8c4914ebf4f675b10af6268b3da50", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658432048, "uuid": "9a8fea11-98d4-4123-9bf6-76c95a6acf80", "comment": "Malware payload (Mirai)", "value": "4e380de3a25930f594e54122ede9001917dca166", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658432048, "uuid": "513ba0d8-d96a-4602-bca5-5a3c8d3b08ae", "comment": "Malware payload (Mirai)", "value": "7dc618cb0b95f937d86099eb07d6baa60a3f577b9da6d33e14cd2b61c8bd6ffefe04b1be371c6ce3d8fae1104dc5c934", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658432048, "uuid": "87e4efbc-7854-45ca-bebc-db954dd49da7", "value": "T1C3D2D06D6300237DDDAA90F8136607A43CB54F35A093DDBAA2C1FAC2ED404E479A35C8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658432048, "uuid": "130099cb-d2d8-4f05-bf9a-dbcd5f900f27", "value": "768:/yvYLznDEB2iC+sDqC6NtxsfzxPnNsGb9dgBxXAJgGlzDpbuR1JA:GYnnDEBI+smATf9dpVJum", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658432048, "uuid": "036a5a6d-5d85-4274-92a0-e609eaf13453", "value": 30848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658432048, "uuid": "f5813619-ecc3-4a6b-b5aa-d9ac94637767", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658432048, "uuid": "61186f5c-9ba7-4dfc-a947-8333c19fc989", "value": "8d4b1847020d4eb66948d9bf6af62c74", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88de3dd7-08f1-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1658406899, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658406899, "uuid": "4699eebe-deea-4d21-bfca-4c820db4fe3a", "comment": "Malware payload (Mirai)", "value": "49b597b7c30d1cc23a432ec704e660b5", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658406899, "uuid": "c869e1e5-62ce-4d61-ba78-a7b4d0348b01", "comment": "Malware payload (Mirai)", "value": "116137188b724eb4b815c64e4b16c62ab2e95fe63ee58a07edbb19549eac4c60", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658406899, "uuid": "4fc02fda-d710-487a-a4ba-86bb9b02cbd9", "comment": "Malware payload (Mirai)", "value": "436fa2fb9d7fc8190ed30c3e9f080af198733ce5", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658406899, "uuid": "e9217366-cf3a-4a55-adfc-5cf15e5ca211", "comment": "Malware payload (Mirai)", "value": "1eb09e4d393c35b800ce99398cf8190605cb4dbf4b8a556d8aa1dfd68f55b525f663dab4b80eb3f68e7309bd66890a69", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658406899, "uuid": "a447e965-38df-445f-ac9d-e1bdd319e45c", "value": "T14E03F1D252BFE375F45150BA165BC7E874203DEA083753F529ACA9DCFEB89407925C80", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658406899, "uuid": "0ca7f939-b782-430c-824e-974198fd5b86", "value": "768:3t2XBcavzQsi23nCWTPQOwoV2Fids4hRk9a4bnWlATV8x0gf:3twcassiYCWTPzwDFH4huBbnWDRf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658406899, "uuid": "b01b5179-84cb-4f67-8b25-170ab92543a3", "value": 37752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658406899, "uuid": "9874e57c-ba4a-40ef-99db-24c51c54f81d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658406899, "uuid": "9da33c1a-0b33-4120-8a38-d31d2fac53a9", "value": "home.x86_64-20220721-1234", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b509b119-08d2-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1658393659, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658393659, "uuid": "82338000-7b9a-4acd-b464-0581641d2b8b", "comment": "Malware payload (Mirai)", "value": "93c9e84d537ddbd542bd5bd83a8b48b6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658393659, "uuid": "cf83c796-5067-433f-8616-2b69dd481126", "comment": "Malware payload (Mirai)", "value": "12da7d910d8a37013ed710a2cd85c1257f5197886f2081d9ff9bbe38f39098a6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658393659, "uuid": "4906f442-7855-4595-b518-0af3ed3c4666", "comment": "Malware payload (Mirai)", "value": "c1ef2a960d20b462aa2f2426085cdbd924f67ebc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658393659, "uuid": "464d3371-f99a-4532-8cbd-bcdce92fa2c2", "comment": "Malware payload (Mirai)", "value": "3bb13d7f4261d0c7558efd7a2e09e2d6d982486f49fb0a36b876dee9db92211bcc3f6bab6e0e51ffb94c73c366184002", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658393659, "uuid": "754bf74b-1e40-4a1b-8b7a-235439568082", "value": "T105832E9A7F913F7FD81ECD334298CA06129C8919539ABF7B6F24E508F64610A59D3C8C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658393659, "uuid": "605e3712-2714-4bae-95c8-96def69de6ed", "value": "768:lHzQ69Q67w0Mds0I4TyMCTOiwb9MsN0TaikLKmdKvcemEr0CObDrWHb6lLcElVE:9idJuOrdNeaiCSEHbDrEWpcElV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658393659, "uuid": "e7a60237-94da-48de-86a1-23bcf90db829", "value": 83716, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658393659, "uuid": "cc969989-d8c4-4b89-8329-294d5a9d9a7e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658393659, "uuid": "ccff9c47-21fe-4e12-b468-0f275f9ca285", "value": "93c9e84d537ddbd542bd5bd83a8b48b6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c52ae0e4-08be-11ed-93bb-42010a9c0043", "comment": "Malware payload (RemcosRAT)", "timestamp": 1658385096, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658385096, "uuid": "ca6add56-eb91-4958-9d48-42afd6c7602b", "comment": "Malware payload (RemcosRAT)", "value": "1dac2ce20aa8c2d5898594c18307f656", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658385096, "uuid": "6551b8aa-392c-42e9-9de4-bf57807af001", "comment": "Malware payload (RemcosRAT)", "value": "12faf0e476091f29e78e58760c95a7d6191845fd37c55abc4a76fba867f3002d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658385096, "uuid": "2633b60e-8098-40f1-b331-a10d4bd49c7d", "comment": "Malware payload (RemcosRAT)", "value": "cf8afc566f3b7657f493058881c31eedb75a8cbf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658385096, "uuid": "ff764092-a826-4cc2-9cc7-a296f3b2e692", "comment": "Malware payload (RemcosRAT)", "value": "7de6a03f50dfa1079c47012902db207ed4965f8835f0f8d1d543e11f26ae9c0c92002982249e93f7d1ce74256b255695", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658385096, "uuid": "1777b536-0a8f-4514-a9d9-522991c40004", "value": "T1A9157C22E3A1CC73D4221A7E5D5A72A49C2D7F213E29F58A2BE57D4C1FF964034292D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658385096, "uuid": "bdb0598a-bf5c-4a43-b9c1-ed1a9c1899bf", "value": "d516d5168ad28c9c6268d5dbd555a673", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658385096, "uuid": "111df231-bad4-46c3-b435-e9d6471245a8", "value": "24576:3l5YzsDC+AbbRovDGw3Ny4EYysaxtVSn52pAf2rDNtl2aCHX:3rGJ3bNSn52KN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658385096, "uuid": "da842118-7a13-47f2-921c-ef22b9f9414c", "value": 920576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658385096, "uuid": "d9216fbc-d88c-4d93-bfb0-8ec84031b4c9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658385096, "uuid": "caad319f-6f8a-4207-995a-172fea6e4c1a", "value": "PO#15032016-A0019754456777765.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "427313b0-08ef-11ed-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1658405922, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658405922, "uuid": "368a56ab-0932-4fdb-8b47-9cd4e9e3cf7d", "comment": "Malware payload (Formbook)", "value": "4f277a8f2b20bf3c9233c333180a615a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658405922, "uuid": "c256e799-93ff-49a0-8971-37968ce93ebb", "comment": "Malware payload (Formbook)", "value": "130bf974fe6d7f38f001ae98b3e4056b1b00fbb33c994f5114b958fbf6091f18", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658405922, "uuid": "f8298495-3079-4138-ac78-e0216961ed0c", "comment": "Malware payload (Formbook)", "value": "4b2b4edcba5037c57f90e40779dcd1f94cecce0c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658405922, "uuid": "5aee9933-fcb3-4b60-9e23-f1dc0aa0727e", "comment": "Malware payload (Formbook)", "value": "3967fd8f9361a8ddba26fe70b514aa04fea107c5cc6b2fdfe08ef62c363d5d2acd8e44b8a1a975c888f09183accc4c03", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658405922, "uuid": "50564800-eb62-40a9-9ba0-517e32ec6bef", "value": "T1E1D4023771EBE502C63842F240E3514817F3A30EB076E55F39DE26A98AD57E65A813E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658405922, "uuid": "ab7fa334-dbd6-415f-a706-4832cd1b7d1b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658405922, "uuid": "f7489802-c010-443c-afac-38cd62a261fe", "value": "12288:BFhgg31hMqYtfb8i5Mh093e2wou5cPkx8:jHMVJb8QMhGocMx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658405922, "uuid": "46e9cc0d-2c0d-4633-b846-fb49c42aeb1f", "value": 628224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658405922, "uuid": "34eeb20f-b91c-4a2c-9461-767425ae916c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658405922, "uuid": "65c322ab-85c4-4681-8961-96f02f0f85cf", "value": "PO_76638800.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7a380e0-08ef-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1658406199, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658406199, "uuid": "417118f3-8b23-434d-81df-293c6a7b0317", "comment": "Malware payload", "value": "1caa525fa547f4fa165c55d4c8a38ac2", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658406199, "uuid": "c17e1a35-850a-4ec6-b2ea-5700d475908b", "comment": "Malware payload", "value": "13e1a89d0793e5c67b1322a8a51438137d61944a5c9e1170b3c4d08c6f86eb8e", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658406199, "uuid": "c2b6b997-8cba-4266-a474-fe276d9475d3", "comment": "Malware payload", "value": "0658479cb9b97ae99aaa30bc53186b09d9117ca5", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658406199, "uuid": "db94170a-3ebd-4e42-a1d0-db7e720b7052", "comment": "Malware payload", "value": "f4ed167b4a80ec198f8f1027f2f26ff7fc36b8e49c88aa9bd2881afe23a88a2278de2092d1d1480f4da567d46a9dae58", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658406199, "uuid": "3132d6f4-8cac-4994-abf6-feb603e9275e", "value": "T15134ECA0685F49B2E608DD1E25A4F6506EBAFEFB30C1147123AFE470CF55AF29EC8550", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658406199, "uuid": "01e95191-4d7c-4d04-bbb6-da76bd796b19", "value": "1536:iS3/Z8UbiLlfvbyIrOorl7UBoHt7D9nUZVzFz76mAg5eeVhMDw5wfLc:i3Lfrln2VzFtr5RDAw5wfY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658406199, "uuid": "c48c4679-03c1-4c5f-9555-a235ae8d1fff", "value": 240314, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658406199, "uuid": "f0f567a6-cac3-40e0-91f1-71908903899c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658406199, "uuid": "85003c95-5763-4748-aba3-b810c682210a", "value": "New Order.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5654e88a-0900-11ed-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1658413257, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658413257, "uuid": "229673b3-3b46-45fa-a913-251ab940fda3", "comment": "Malware payload (AgentTesla)", "value": "0848d1d303d251c3beaea721be19aeb4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658413257, "uuid": "dff1cb0c-7ac8-4450-9d7d-a5ffc28dfc86", "comment": "Malware payload (AgentTesla)", "value": "145f571c145864a1e1ccac7dadfed7034e77d99a8bcff94ba0674d1c140bd31f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658413257, "uuid": "45685989-0187-4c84-ae49-a9ce89b3da29", "comment": "Malware payload (AgentTesla)", "value": "a7b14a9223076fc67f8c8f5f4926705f5201cd33", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658413257, "uuid": "5251b796-1c5d-4de2-9316-58979a4fe6c2", "comment": "Malware payload (AgentTesla)", "value": "05b603102da76710e6a2c414b2b0acda1e15eda6e76a2633f56142eaf25c6b443c677d791625be13b532b930c4f95fc0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658413257, "uuid": "58de52fb-9d8b-457a-ae44-6c11f3490925", "value": "T1B6D4023371F3E905C53887B280E3564817B2B30EB1B6EA0F349E759949D63EA5A807D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658413257, "uuid": "a03bf63c-d460-4e82-98fa-c6650edec8a3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658413257, "uuid": "5f8d3861-80cb-41e9-8c99-127fa13bca7e", "value": "12288:BmRgg31hLx8vfqdcv9u/9j2TSNMd3oJEPYJboGA9u/:B2LxqfqdiW9j2Th3om4I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658413257, "uuid": "af17a9c5-75c4-4589-a59c-92cc37c1b43c", "value": 652288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658413257, "uuid": "fbf2cc3f-5bb9-4239-a2ac-c9a939356da3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658413257, "uuid": "960cb9a8-4cb6-4b01-9a6c-46298ea6996c", "value": "Order 3067729.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6428a751-08cf-11ed-93bb-42010a9c0043", "comment": "Malware payload (Loki)", "timestamp": 1658392234, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658392234, "uuid": "db42b81f-4c18-4f41-b04d-03cc2c0d1a22", "comment": "Malware payload (Loki)", "value": "1cb62e4cdfa374ed6f91f9d164060f78", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658392234, "uuid": "cf60f35d-fcdf-4050-8683-619f401dff53", "comment": "Malware payload (Loki)", "value": "152dd4f9a5c3f23aff250ab4392af1888347bc7567fd24328c1049d67aaf3bed", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658392234, "uuid": "28f18c6e-1192-4fee-9d41-1d246640075b", "comment": "Malware payload (Loki)", "value": "4172d7898ace69ce40045bbb7e396001daffdd79", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658392234, "uuid": "6e564eb4-3a8b-4074-b855-be4187aa10d7", "comment": "Malware payload (Loki)", "value": "59f65871fc4a194cee7a07e7eb8b85f2b93ca5713c1dcaa1750b5ba474c4924b8469dd709c4928a6af8bf0466ca02655", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658392234, "uuid": "addb2bfd-865a-4047-8ab6-0e277a29e616", "value": "T17FF4123361E5AB11C57497F52472A38C2FF3B20D30B6E61D189EACEA81E5BD456903E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658392234, "uuid": "3268938a-414a-4a83-99cd-b9e42e26b00b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658392234, "uuid": "99025579-6261-4852-9e43-8ac38e3ff918", "value": "12288:jsMPp1pi4f5l4ZihD2flzDERLTf/b6pVg7DnSRxPCmNRNfKvUkpwA/iXb3WAPexj:dJi4f5l4Jtgfj67g7OzCmNRNSp5Ib3W7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658392234, "uuid": "fb0cad3e-8076-4063-aa68-2bdda29b9284", "value": 754176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658392234, "uuid": "bd1e5468-ee99-4903-a4dc-cfb5993d4a27", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658392234, "uuid": "a7594bbd-ba47-443d-955a-cb3247a36984", "value": "Purchase Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30e1b3b7-0941-11ed-93bb-42010a9c0043", "comment": "Malware payload (RedLineStealer)", "timestamp": 1658441111, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658441111, "uuid": "0da02381-9af1-485f-b2dc-d377febbd444", "comment": "Malware payload (RedLineStealer)", "value": "f050b937d67de033229dddbfcce6f544", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658441111, "uuid": "001fe810-4e87-4c80-9df5-9ac0120737f5", "comment": "Malware payload (RedLineStealer)", "value": "156328ee2cfc566fbb9872ca316dd022455c0ba6c43f3df8de2ebd5871f81296", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658441111, "uuid": "3372542c-3782-4533-9fe9-2ab9e246359f", "comment": "Malware payload (RedLineStealer)", "value": "485387a9c6700b78e05fb58ebdb252ba49bb4aea", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658441111, "uuid": "ff7cb156-a210-4762-b01f-6444cff255f1", "comment": "Malware payload (RedLineStealer)", "value": "96096f2b89ce6bee958749f35adcb525074d9ea000cfd3209523ddc3c696d046f2ffdedf9d097279713fd89a40d681c1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658441111, "uuid": "63a20043-02ee-4320-9835-f466489c5047", "value": "T17154F1227A91C832C6E146316870D6A567BEFCB25534508FB3983B3F3E305D91EB6366", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658441111, "uuid": "e6ad95b0-9a77-46b6-b07b-b1064c8a27a1", "value": "f36d3c9be35d5179c24f5508c2b17a41", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658441111, "uuid": "e1652dfe-18dc-4670-acad-45d52daac75c", "value": "6144:7kGJT8zw1YuwCXueeT8bfWYXagdTh0veD05voOfDvChjG:7B6duw5V8buYXXEBv/fzC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658441111, "uuid": "781b1395-4028-4ae7-ba7e-44160186d733", "value": 299520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658441111, "uuid": "d167fc03-b1fc-4845-b335-74a00215842e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658441111, "uuid": "91342633-9f70-4f46-924f-a444b124bac0", "value": "f050b937d67de033229dddbfcce6f544.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1db4097-08cf-11ed-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1658392338, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658392338, "uuid": "461252e6-52d4-4a8a-acc1-80ddde956d5e", "comment": "Malware payload (AgentTesla)", "value": "2d074085743eb4a777f169b91f785668", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658392338, "uuid": "bf84b192-0bd1-4477-aa22-73ca17dcba85", "comment": "Malware payload (AgentTesla)", "value": "16e7ad0f3c49622609f9e31253a81fca1521fc0ec0501be9773950d500abf571", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658392338, "uuid": "96309886-5304-49d0-80a2-dffce7e0face", "comment": "Malware payload (AgentTesla)", "value": "f685502e18bb8f00d3ed80a00ba5b1156b6280a3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658392338, "uuid": "9e44126d-eb00-47d9-9c1e-1ff7457bb31f", "comment": "Malware payload (AgentTesla)", "value": "3ca69bd409ae87a7a773fc5f907a56b791b448a400c3fe9e72cda2f6f3cc62a30c6b98147c69c4eec98974042f927e4e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658392338, "uuid": "94c925d3-6dfd-4dbb-959f-40c46d1de560", "value": "T1A2C28300F64493B0E3A6577B78EDB14DF39A9D2C430BAA8AF8907D5C06712D11EFA52C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658392338, "uuid": "b7c55a4a-f653-4969-bad2-15c1661177be", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658392338, "uuid": "767a4664-2aa1-45c9-bd1f-040bad981165", "value": "96:SUX92ga48f3AWduYDzpAA1wrHEOitmK6IE9Wl8JhwwqW+fEPfPNAgARricsGbRif:SwIgapwWzp14EOVTJcWuEvNesGFp+P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658392338, "uuid": "eafe9351-ebaf-4125-a6a6-ea88b9bdfeb7", "value": 26112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658392338, "uuid": "c3a78307-2920-4de3-a48b-a914ecbb3ff5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658392338, "uuid": "f03eae3b-2287-4f15-b2bf-48760f881f27", "value": "SecuriteInfo.com.W32.AIDetectNet.01.27957.14461", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06a4b6d5-08d6-11ed-93bb-42010a9c0043", "comment": "Malware payload (GuLoader)", "timestamp": 1658395084, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658395084, "uuid": "cd1fbcb3-398f-40a2-be23-6fb99b38be76", "comment": "Malware payload (GuLoader)", "value": "363b3431208c5a160f703549e397870d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658395084, "uuid": "6aef80d2-629a-4802-9e9a-992cc75098e9", "comment": "Malware payload (GuLoader)", "value": "17986f73309258ece680ea20d2008a36b4a79d5759cfb3ba0269f0e697d49085", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658395084, "uuid": "a3ccfbaf-590c-46f0-9b50-9d7ca765eccb", "comment": "Malware payload (GuLoader)", "value": "db3cf82b092b4ae9d0c837d9b0122e6a85a3b469", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658395084, "uuid": "658a0355-91fc-414a-87bc-bf4ad77df5fb", "comment": "Malware payload (GuLoader)", "value": "bf5a24831f1bb00578bb421b834c95ab3007bdadddcd26e2e7f5a7e5ba6a2946ee116e9a60ce6abca8daba9d5b77ef4e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658395084, "uuid": "bd9d8abc-e34f-4b19-a429-de2902f06587", "value": "T1BEC4027B61E8E725C93853F2107326482BF3B20D7071F25E28AAE9E985E07D592507F7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658395084, "uuid": "5efa76ab-9ef2-49a4-bfa1-57a28bd46f7a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658395084, "uuid": "5edbf86d-fe33-4596-89d8-ec786938abd8", "value": "12288:YsTkZH6GbP/Gb0XpWYT3oAVaizNl/wd1xx8k31h:Xk0GbHmcpW6paGMnxxF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658395084, "uuid": "d66b4f1d-2edc-43af-b6ce-047140c05143", "value": 592384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658395084, "uuid": "7ee3f483-3860-4b0a-83fe-1b616ba1b315", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658395084, "uuid": "420d9a9d-d060-4b7a-b2b9-91645d5a4cdb", "value": "DHL Shipment Receipt.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02f4746c-08bd-11ed-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1658384340, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658384340, "uuid": "538ebd3b-299b-40ca-90dd-8439ce861bbc", "comment": "Malware payload (Formbook)", "value": "12a93b6ae88f8ecff990099a80acd1f7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658384340, "uuid": "ced7991f-8ca2-4630-98b9-4c5de4b486aa", "comment": "Malware payload (Formbook)", "value": "18061c8a31f3728962bed4acb1806d2c87cfcefe616e4003fe8c9569e6877a8b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658384340, "uuid": "9ddf43b7-0baa-4224-be31-9b261466815c", "comment": "Malware payload (Formbook)", "value": "2dbbba0807ec310cde97c824e1d1bd18933ed2c5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658384340, "uuid": "ae1914f9-f9f0-4e21-8288-d5f610adfe36", "comment": "Malware payload (Formbook)", "value": "d19cb1217713438d4655844de9b10f990504bdef3d62a42efca11e3c48f2cfa16127d03d29a6d21ce3f12561a6c2809d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658384340, "uuid": "71cbf468-93ae-4787-a563-5d1d7ec06647", "value": "T173051277A1F4AB52CA3883F21063A3891FF3B21E74B4F51E249EB1A680E47D155507E7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658384340, "uuid": "1c24b84a-25fd-45b5-92af-4662bd84e84b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658384340, "uuid": "fa19f6a4-1ca3-498b-9177-8d6f14dabcd9", "value": "12288:ZUs3pNXcW+XSDOih5YD4Rbgtpcmvt9vs2ynabm5wdT60My5cWyd0ix8831h:BpNsVXohCDPvrvEom4xMIQx7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658384340, "uuid": "84593af4-4e5d-4cc5-9014-020b42a19091", "value": 859648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658384340, "uuid": "a702bc63-8e0e-401a-9529-664eac0d12a3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658384340, "uuid": "ab780bfd-2ce3-4c6a-9681-c0db711aab05", "value": "PO.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e323025f-08ee-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1658405762, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658405762, "uuid": "ef975534-708d-4417-a70b-c82ecb3c1d75", "comment": "Malware payload (Mirai)", "value": "118c28010b0cceafb87a40e78f939bdb", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658405762, "uuid": "521d9803-0642-4af5-8464-b3a90f0a97ed", "comment": "Malware payload (Mirai)", "value": "186e488154447d1682b52f140318101bb4562bdef3de7dba21a8521adc5c7b0d", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658405762, "uuid": "5822b05b-5d21-472c-a85e-f3c2ac12b4b1", "comment": "Malware payload (Mirai)", "value": "556715c8cfb4b06bb0fc7e7e4c5f9f3643674187", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658405762, "uuid": "5f7f901d-f358-4e84-8149-3fb6a2b9c6eb", "comment": "Malware payload (Mirai)", "value": "b6190dc911ec6d52f5ea93a5ebdce728e257243edcee5cffb7781face18d6d192f473a571db21eb4aa2ef90fdd99fb27", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658405762, "uuid": "474cb793-4155-4011-86a3-435ffdb5b6f8", "value": "T128B2E12353CE24A0C1B20972E7BD0391729F1775A7EE71A85A15052CF1B209DEA772DF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658405762, "uuid": "26f65383-6adc-4712-880c-e4c29d9a42ee", "value": "768:dhKsreu7/946xveXBj0/ABAGQDsdl3UA4:dhJb946xHABArDkm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658405762, "uuid": "b54d003f-fec8-4a5c-8d1b-821c8ad687c8", "value": 25328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658405762, "uuid": "d29dd37d-8d7d-4773-98ca-1367fa821f52", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658405762, "uuid": "0c1aea93-8e97-4fbb-bed5-fbd04d1a0c43", "value": "yakuza.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33d3d9f4-08df-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1658399025, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658399025, "uuid": "ba53c377-064d-4187-8a15-d6820f593206", "comment": "Malware payload", "value": "30c98776bbd03fa55d2197d25523fa7f", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658399025, "uuid": "ba13e8a4-20a2-42f9-a21c-6543f2a2ac33", "comment": "Malware payload", "value": "1a389a8af33de84123f6443959e3fbc81aafdc958b83dc9b423785b689eb21ae", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658399025, "uuid": "26e8fdfc-3da0-4653-aaf9-eafd3808b7dd", "comment": "Malware payload", "value": "11358705756b4b10299a5e39ea274df902c4730f", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658399025, "uuid": "8a37f22f-ec9f-430f-b36a-1bb7f9c00adc", "comment": "Malware payload", "value": "2293e849c183b8d6fd1d9f111e7fc5d0278c7224e94a347d60782e6578f14ba104ca710ffd2c05e407bebcf48693cfbe", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658399025, "uuid": "2d3eb7b2-f03c-4772-bef2-7b6b34e8e920", "value": "T116366D23BB84753EC46B1A3A4537A36C9D3FBB6179128C9B5BF0084C8F365413A3A657", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658399025, "uuid": "e4055b73-1a57-48b0-ab42-1d9dfffda5d1", "value": "98304:FOYvAViTqvofd8SM8Q35Pnu4v8s25X385bPCmy:FOY2UdVe35/lNbPCz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658399025, "uuid": "666cf2e9-adc2-4ec2-8368-072a30d16b9c", "value": 5207040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658399025, "uuid": "9d127963-b822-4f0c-bd9b-c93c9bea5f24", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658399025, "uuid": "0db42200-832c-4527-a392-683268b80ff0", "value": "Processo \u00ad\u0192\u00e7\u00ba\u00ad\u0192\u00e7\u00c0439244djcq.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ce30707-08b9-11ed-93bb-42010a9c0043", "comment": "Malware payload (BitRAT)", "timestamp": 1658382639, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658382639, "uuid": "91261cc5-0dda-4929-a7ed-5804ba5a0381", "comment": "Malware payload (BitRAT)", "value": "507da88c0faa082c6a5974a173feafef", "object_relation": "md5", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658382639, "uuid": "b636b3cb-37b0-4c63-95e0-f9106ab50504", "comment": "Malware payload (BitRAT)", "value": "1b9c9b834da58ea5a48a29ecb1fa94be9745a48484417ff2caf6ed70f1a50cbd", "object_relation": "sha256", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658382639, "uuid": "3fbdd230-66c7-4065-98f7-3205ec6037f1", "comment": "Malware payload (BitRAT)", "value": "62bb282d4214dfde18242f77f19f818127552e1d", "object_relation": "sha1", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658382639, "uuid": "2b77c680-3959-47b6-8e48-3c61fbaec16d", "comment": "Malware payload (BitRAT)", "value": "ba39a3f3b5d67a3d8bf2cd02b6d6d00ca75ce6ac621566e476da88c898be077282ab8bc6ca2eafecf62dfeec038df432", "object_relation": "sha3-384", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658382639, "uuid": "ef2343f5-9269-4727-830d-b05d0eaca06b", "value": "T175A523B70ADF5B61C0B3FA7732F29A5508E90C24A1AD4E43805AB53B0BFF98719439D5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658382639, "uuid": "6ef0315e-2deb-46d9-95a7-0c122be9984b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658382639, "uuid": "eb3849be-e9a7-4ea8-9c35-aac2f63e0004", "value": "49152:zK5yp5JIUOcIz2XG4fQoT+OrbCShLrynFgVrUS6:Oyp5eU24hT+Or542VUS6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658382639, "uuid": "9f85f08b-01a8-4f0d-82d6-3f1682df7336", "value": 2225152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658382639, "uuid": "d0e894e2-3c32-48a0-b5bb-8249ee22c7d4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658382639, "uuid": "4bcf35dc-943b-4b43-8f0b-1b41be3fd90c", "value": "ORDER SMAPLES.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92b720d8-08b8-11ed-93bb-42010a9c0043", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1658382434, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658382434, "uuid": "0c777a72-98a9-4ee1-9f34-6f67305f8deb", "comment": "Malware payload (SnakeKeylogger)", "value": "af2d017fe44b27c4c09a606fb61ac882", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658382434, "uuid": "a96102c9-f7e1-4a4b-8f88-8717e1ced7a1", "comment": "Malware payload (SnakeKeylogger)", "value": "1bc77023e4295f4bf56e32ce4ff7a6a21d650e69552adf6b12477a519abb4eed", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658382434, "uuid": "66059cf3-118d-4199-ac91-84a58a616294", "comment": "Malware payload (SnakeKeylogger)", "value": "551655d6a5ff91586b7e48f83c09d50f8a292576", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658382434, "uuid": "77b8a933-33a8-4e42-9c6c-409a0afdd9e4", "comment": "Malware payload (SnakeKeylogger)", "value": "f2c46ccedb355828d4ad167d107621399ae1d4025f4692dc3bd0ab4be1326d973e5a593c00feeb81506d5602c5e2b91d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658382434, "uuid": "13a69e91-711a-4f3d-abb3-affce2887b5a", "value": "T138E4499CB690B1DFD897C5768FE82CA4FA61B876830B5127942309AD9E0DD87CF141B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658382434, "uuid": "4c1d41f2-2b05-4f01-9a76-4a361336c3bb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658382434, "uuid": "b652be3c-c973-489e-9993-ceb11205a535", "value": "12288:/KQgleK+V8lLSVKtlAv/HVwK9qdM+Qis0nH6umfdtCCQo4TYq8by4eYNxKBNOQ1B:yQJ8ULfL8YqPPcQBNNQsx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658382434, "uuid": "aa5c77db-f4ee-433c-8cd9-fdc59c5c78e6", "value": 705536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658382434, "uuid": "8389f4af-e250-414e-b81c-b751e7e5e4ea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658382434, "uuid": "74104bd9-99a1-45d7-8398-ecfffd1056b3", "value": "OUTSTANDING PAYMENT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e02f1350-092b-11ed-93bb-42010a9c0043", "comment": "Malware payload (Gozi)", "timestamp": 1658431956, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658431956, "uuid": "19c045e9-1236-4aaa-80f4-061a69f0a040", "comment": "Malware payload (Gozi)", "value": "87780a3379d6cfe3d2d5f6c2b6e80837", "object_relation": "md5", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658431956, "uuid": "283bdcf6-24f1-41ff-b1a0-9abd2330fafd", "comment": "Malware payload (Gozi)", "value": "1cdc0c36ddb9c98529f73e325411d09c5f3b2a75c4de5440c8314c0266d5efcc", "object_relation": "sha256", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658431956, "uuid": "75a02f59-3178-4da1-a529-a31f0afab4a4", "comment": "Malware payload (Gozi)", "value": "a94fa02101068469dd2e445a38f41c2090c24227", "object_relation": "sha1", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658431956, "uuid": "85fabdc2-f03f-4d98-b0f9-c37351c64764", "comment": "Malware payload (Gozi)", "value": "ac684eb82dce01ba2e923180358c38d592b6e73d41a0faac170b938f459d0c7c69dc2098a0d5669635033717c15882d1", "object_relation": "sha3-384", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658431956, "uuid": "9e8f67fd-7eca-4752-9ec9-51fd2336f38a", "value": "T13223F191D9DDED8ED2374AB550A0C0E2590A8800960CDDCA5E51F8FC5A703F75B8EBAF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658431956, "uuid": "08aaaaf9-0eb9-4eaa-a1b2-adf5c2687fa5", "value": "768:m9xVFubplnv58TGsaEVl3R2F4LBNB1U+mRQt+fBm7sMO+81/nNdUCcPWDfpdPOpC:ezFqfnSGyVlh2CLx6C+ZmgL+8FnNmCcc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658431956, "uuid": "d81a86ac-aea1-4e4b-be75-425a458e63c0", "value": 46260, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658431956, "uuid": "696f3bc8-b514-4597-b7c1-554dcf86a935", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658431956, "uuid": "bb598545-8825-41ab-bba0-230a1b8f5bca", "value": "RAV_AR059915815_DA1_A_5.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "443433cf-08b1-11ed-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1658379296, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658379296, "uuid": "98259891-032a-45fe-9ba2-8369c7fbe67f", "comment": "Malware payload (AgentTesla)", "value": "1ebde318458f9fd134844fdc1aa81908", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658379296, "uuid": "b8431044-c94f-4514-ba6f-5f32fcbe5773", "comment": "Malware payload (AgentTesla)", "value": "20f3d098a0437344f3a54a5ad084c9c621a921a05c3cd60dfafb1001e7ed1d55", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658379296, "uuid": "80747a9f-6c07-47dd-9efa-04bd7937780f", "comment": "Malware payload (AgentTesla)", "value": "dac44dad49d99d8259d6687251ac1430fe95801d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658379296, "uuid": "f6fed4db-3f68-4cd0-bcec-f9f48477a109", "comment": "Malware payload (AgentTesla)", "value": "8ec33c990e43fbe253489557971f991682e4e05d0eb692f1ff843e063ddffc091a834e4253c5a63ea36fffe43f96c700", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658379296, "uuid": "698c9391-26b1-4fbf-8d26-02512c912336", "value": "T191D4027361F0FB15CA3893F2016356882BF3620D7474E66E289EE5AAC4E4BD857017E7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658379296, "uuid": "30e187d1-5f85-4f39-8921-259e6dba8b99", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658379296, "uuid": "c1b6a736-f674-4363-9999-e7b51560ac36", "value": "12288:9sJ80lOLDc60Mvkfft/PgLeQHWpEzOgY2QSkx8c31h:7uakfF/PeDzOgzQSkxz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658379296, "uuid": "cac689c2-86ca-43e1-9e86-14213032b92c", "value": 625664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658379296, "uuid": "8dc9fdad-c638-4797-8278-303408324e9b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658379296, "uuid": "18108fa6-0fb2-4ab3-8797-72d58c0ca5c2", "value": "PURCHASE ORDER.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81970256-08f1-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1658406887, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658406887, "uuid": "f09bc753-a293-4aad-a5d7-4ef9d1d3a231", "comment": "Malware payload (Mirai)", "value": "1aea90ec21374ab909ea681f0eaddffb", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658406887, "uuid": "ea118cf3-6c4b-44bb-b059-79e264cd4050", "comment": "Malware payload (Mirai)", "value": "266b7700f5b47dfc75a4d2f8eee1ff703d6c83167205ae81bd52f30f528416af", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658406887, "uuid": "01a0f488-b43c-4abe-b9d2-ce409f581f32", "comment": "Malware payload (Mirai)", "value": "d0081ae1dc1a8123082c2e126203a2f2f162c221", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658406887, "uuid": "1d574d2e-66ae-477c-a1b0-19c39593684f", "comment": "Malware payload (Mirai)", "value": "fa22f5720b1d62b98a9c923c242287873a212acb2cec87550c40fc4269d29437398ca9d0624d190f75861137af39a607", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658406887, "uuid": "719abf40-d262-4aea-aba9-89bb77c45c0f", "value": "T11603F2519A27AC936BA07D7FBCE0CF57AA03AE72CED471B20795526845FB8CB6060640", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658406887, "uuid": "aecab6b2-a4d0-4cda-b7b2-393898409776", "value": "768:rEDJuTK5X/xqy2plJcyAqxY+wY0HGT+DwhztJVt2hfv/BlYUjx0kXNUh0vW9q3Uh:rEDJuTKp/2LJDAqxY5GT/nPeBlYUFNre", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658406887, "uuid": "c73cc0ab-44c7-431e-b720-8111c632c24a", "value": 40908, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658406887, "uuid": "839c33e3-e66a-4ba5-b547-e171d89d49fb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658406887, "uuid": "f80480e4-b2df-4d0d-864a-bfce686e2182", "value": "home.arm6-20220721-1234", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0eaf293a-088b-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1658362885, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658362885, "uuid": "398a0b33-9f79-4ba7-8334-581b242b5d07", "comment": "Malware payload", "value": "016c2cceab849038cd8e3123da47754a", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658362885, "uuid": "618015d8-50e6-451c-a0e8-2592b65dabc8", "comment": "Malware payload", "value": "29e6865131d07cb4bdeb2833aaee3c0908f7ca87fcabe7ebccf35cf03ee6530c", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658362885, "uuid": "3f2cbc21-2b9e-40aa-8814-8a292840727b", "comment": "Malware payload", "value": "f168d6075098a8a2c2d956269cadf0cdd2511474", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658362885, "uuid": "c890ebc5-57c5-4dca-953d-3250a7d7019e", "comment": "Malware payload", "value": "fd33932d713c57b0f8f9ef106c4729152c1b788aa3be1ab785ca9916cffbde88606ff9e8299adba0367cefa0a5aa6861", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658362885, "uuid": "f3165e34-3a39-4815-92de-98455f6ebe12", "value": "T1EEC2D03F5647D6F0E271D0F2D99A4314AC690FBB22BB9D46A510E8A1D81607DB137FC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658362885, "uuid": "6a0cfa6a-854b-41ae-844d-007f88fc7ebe", "value": "768:BWyygbaZaZlzl7MWe+YQnojXjHJgGlzDpUYsF:QyZb3/zlEQojjFVqYO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658362885, "uuid": "fde27125-7fd4-41e2-b8ae-3ced680e0466", "value": 27920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658362885, "uuid": "bbe3c306-f4ee-4c82-9b29-502a8f38da68", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658362885, "uuid": "61de7b20-3683-495c-b123-8933790216c4", "value": "yakuza.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a6fbc0d-092c-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1658432027, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658432027, "uuid": "6df286b9-5f8e-4485-87b0-1a43215af78a", "comment": "Malware payload (Mirai)", "value": "ee6e24fab0626ae8d4bc9fa9d603ab1e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658432027, "uuid": "6ad55d4c-a8ea-4636-b349-bec188e021f6", "comment": "Malware payload (Mirai)", "value": "2a5400fbc7136cc8119e277dfd79755f49a49c515548b6dc52d2b9eac6fdc464", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658432027, "uuid": "e8f91802-7e38-4fad-b826-56888d539559", "comment": "Malware payload (Mirai)", "value": "3224ed93e2c57ca7f85927854d2a659ea12f75a1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658432027, "uuid": "e7e2b30b-0b7f-4175-a96e-7d68d5eeee51", "comment": "Malware payload (Mirai)", "value": "3944235c7a86dfc8ea5d85f21348303f249431f1b3f41aa7f628690464a4b7c44d8e15e3f7b1698305a34c1c0b2f821d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658432027, "uuid": "b4be1252-765d-478f-ada6-b4c4b68542ac", "value": "T1F6332A8A64112E6DE9DA5CB981764F0ACE541210B093171FB3BBFDC33933368FE66949", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658432027, "uuid": "c3f189a1-dcb3-41a1-8fa3-61d4096b2573", "value": "768:UaRTre1lS2oueg2me2nPQCHEM/ArPwqLWHG2TqOhRol7gSu9+f1prZadIR0eNia:Ua0zoRg2mew4ChAVLzF7gSyg1pVa60a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658432027, "uuid": "bb674f2f-2380-438b-bd4b-42e418e17a25", "value": 52820, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658432027, "uuid": "406bc2d7-1ba4-4f40-9ce3-f1ea6842e52d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658432027, "uuid": "1a046044-0d56-420e-b609-b80e3156d311", "value": "ee6e24fab0626ae8d4bc9fa9d603ab1e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43b9c8a9-092c-11ed-93bb-42010a9c0043", "comment": "Malware payload (Socelars)", "timestamp": 1658432123, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658432123, "uuid": "7b52e384-e3ab-451c-b7b3-38b43802ef32", "comment": "Malware payload (Socelars)", "value": "1426a551fc8c26bba46df15c25821619", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658432123, "uuid": "15f05dbe-d23a-4b82-95a5-9d4d71b216e1", "comment": "Malware payload (Socelars)", "value": "2a7b4a20039c86a7007d8da28023a95034b42d5e0404ef4f6db67d7dfa8b271f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658432123, "uuid": "2ae20b77-315f-4e09-a025-c4e40701786f", "comment": "Malware payload (Socelars)", "value": "e3367366b0b7479ac7a485516722b08f3e1c01eb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658432123, "uuid": "c0ea8733-88f2-4684-9be1-fe4b7653943a", "comment": "Malware payload (Socelars)", "value": "e5c191344a5271fe8d4290cd991f920c4590495fb6e9d9d814a9380e033e288e947e35dd19b92adfee030264350dba00", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658432123, "uuid": "6b21aa9a-e42f-4891-bb66-a4645731902f", "value": "T106659F11F642A036EDE3007282FF5AFECD28BA21031454D7D3C45D6A6E619F27A37A5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658432123, "uuid": "431e6d10-e8f0-4ebf-9aa0-e8d9d92efeb5", "value": "d69e4c13e25f0ad622344ac56118c0df", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658432123, "uuid": "752a6698-3311-4591-a017-d1b0515b38a5", "value": "24576:HsLp0FasdJu/+/dfMs2KLoyaU/5DejgtMyPtTEx+o/GMd:MpncZO+bCyPtTEsoOMd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658432123, "uuid": "2601f12c-b2e1-4568-bbf1-43fb3033b6f3", "value": 1494016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658432123, "uuid": "3fb02feb-8393-433c-8358-ca2eee2ac4b2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658432123, "uuid": "3528b3e2-b918-4a38-b07e-74a070f0f922", "value": "1426a551fc8c26bba46df15c25821619.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81e2aa5b-08df-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1658399156, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658399156, "uuid": "335067bd-5385-4ddb-8e3a-76dc24d2c44d", "comment": "Malware payload (Mirai)", "value": "2f98c46b6fc1f4436ca8736b517dcca3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658399156, "uuid": "8018dcba-6a79-495a-a47e-ec350becefe4", "comment": "Malware payload (Mirai)", "value": "2ab0b90f6356566e1c7af83f9f9925b7358eec7eb7e71a5b1e6116ee2715e25b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658399156, "uuid": "8e0c2dad-2f48-41e2-af4c-caee0c7e1106", "comment": "Malware payload (Mirai)", "value": "99283e529a94baa3bc675c41b5743a41507a4b90", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658399156, "uuid": "16acc6f1-1b2c-4fd0-90eb-195d01269ef0", "comment": "Malware payload (Mirai)", "value": "297c03f5e303f9182fd2d6cf03ae55255edff78bc9a3387908628c20d0ab5712bd3dab1b44b048f1905a62287204779f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658399156, "uuid": "2a623b8d-7f8b-4a30-8f3c-ffbf1aae65db", "value": "T1CAB3295AF7804B13C0D61779B6EF42053323AB95A3DB730659186FB43F82B9B4E53A06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658399156, "uuid": "8c534b95-8415-426b-88e3-3029fdb52468", "value": "3072:3XpgBpweMGtaUM3Y1YzdEJYXHo3M/98aBKGv:3XpgBpxMGtaUM826YXHwM/9LBKGv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658399156, "uuid": "1f3889e5-035d-4ab3-afce-2fb6e2dba96f", "value": 113159, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658399156, "uuid": "19a01b99-176f-4fea-b524-92ed4ff5fe27", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658399156, "uuid": "3ecefa2d-a989-4a65-a2a8-261698a56eb6", "value": "2f98c46b6fc1f4436ca8736b517dcca3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7efb5f52-08ce-11ed-93bb-42010a9c0043", "comment": "Malware payload (NanoCore)", "timestamp": 1658391850, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658391850, "uuid": "b88cbd95-41aa-4613-a5a7-b7d3a8ce22da", "comment": "Malware payload (NanoCore)", "value": "913491e68b3669d579d3fcc800ddaaab", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658391850, "uuid": "c870d8cc-43d7-4041-8ffa-dab0f2c2162a", "comment": "Malware payload (NanoCore)", "value": "2b8929b1aa46a540455e96eca861b13e2915532c84baf7a416d40d6765fa94c0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658391850, "uuid": "d939e194-7add-4835-8911-87a205059592", "comment": "Malware payload (NanoCore)", "value": "08573569369afb45841c4d81b4ade3b75f7600af", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658391850, "uuid": "65356642-c54e-4e15-b0b8-24ef8b2757f3", "comment": "Malware payload (NanoCore)", "value": "13684ddb7867787f1c3186304c5b0f8fe732ef5fbbaaa3c459e09a11cb0e653a433925d88dd3e480c82e152408872d80", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658391850, "uuid": "99094bdf-2503-4e83-ac64-4021c7f163a8", "value": "T117051237A1F6F721CA3C47B110A21A881AF3701D3474F66A24ABF4E9C5E47DA66507E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658391850, "uuid": "d7c1419f-03f3-4e2c-849d-3399a943c02f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658391850, "uuid": "833918d6-6c18-4ddc-9cc4-1e9ea0bad159", "value": "24576:s/bpAF3Q4uDOCC9UEI2ecz77PknWBWi0BpPywSNzBxj:c+F3QxDLSU/2nz7NBWlBpPABt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658391850, "uuid": "4849c577-8f01-4fec-a8fa-5a467dbfa475", "value": 873472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658391850, "uuid": "10cb1158-608d-4635-81af-21a11c9121e3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658391850, "uuid": "ce8ee406-8931-4b36-837b-55c97f328a72", "value": "EXP.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5073a98-0927-11ed-93bb-42010a9c0043", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1658430246, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658430246, "uuid": "2e7a9443-8a61-42ef-aa61-70625fa40abd", "comment": "Malware payload (SnakeKeylogger)", "value": "e9a6bacd41518c72b0a59c31cf40a002", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658430246, "uuid": "b410f0d5-1e82-45de-868a-c8d034446c2a", "comment": "Malware payload (SnakeKeylogger)", "value": "2b93e7fe3b141e5d7e02a4e47d8985b670d891afddaaad3e77ae2c436401052f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658430246, "uuid": "6424e2fb-aef1-48d1-a1bf-b68c5bb8625f", "comment": "Malware payload (SnakeKeylogger)", "value": "fd4fd55e9c379c3f93bb5eaed4f9cdfd444a0411", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658430246, "uuid": "c18557f1-29e0-4aa7-8d74-fc99bb4ec4c3", "comment": "Malware payload (SnakeKeylogger)", "value": "aac6b5c99e0c36a7f6a3c730ecb6c695a5575b7afbaeca7df1cd7b2d9d12bc6313f82a944a5216cecf8b5d7dd94c9ea0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658430246, "uuid": "cf6af83d-36ca-477a-bf39-df7300e15289", "value": "T1E2C4013771E6E911C53443B380E352481BF2A60AB1B3E60F35DF66A989E13DA97817D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658430246, "uuid": "fb1c264b-fa3d-41b0-85b3-c72c87d3e1ab", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658430246, "uuid": "d8c912f8-7c43-4dac-80f7-f91c339e101e", "value": "12288:4gg31hWx8LqoFu+w7p+CS7iSqxGbWabqH/JZ:2Wxp7Axqxlabqx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658430246, "uuid": "e8c146ce-c2cb-480d-a1b8-8b974e7a122f", "value": 564224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658430246, "uuid": "c8d04600-60e4-449f-95ba-8526d5b40f5b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658430246, "uuid": "3a9d17d7-e9a5-462e-9efc-b913449e7953", "value": "PURCHASE LIST (PO#7A68D22).pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "441d8d67-0913-11ed-93bb-42010a9c0043", "comment": "Malware payload (GuLoader)", "timestamp": 1658421387, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658421387, "uuid": "47925415-276a-4b0c-9bfa-65955c684b82", "comment": "Malware payload (GuLoader)", "value": "0370299022404d2e085e1b5168b7f601", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658421387, "uuid": "7cba7656-0292-4f35-9a9c-2d6b7f13f5d8", "comment": "Malware payload (GuLoader)", "value": "2c213f07c4fd57a1d8cebd5cc96e1756979c94c639012657f13e7e8e7c9bb55c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658421387, "uuid": "788ab7d7-efdd-43eb-9b03-ae4635dad0d2", "comment": "Malware payload (GuLoader)", "value": "3a61d34d7b85bc537dfaeda5feabc6ae5a86a15f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658421387, "uuid": "89b5fa03-18b3-49da-b2b1-32375be7d6f6", "comment": "Malware payload (GuLoader)", "value": "6d02921f68b5ba06c681a0db5e2b668b94b5a3aafc52dbbf13caf47f5ee103cbe0dad7ceeeea0114d6debe8c819e68d1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658421387, "uuid": "5fb7c0ac-7f2e-469a-a185-ea0fb20f57a0", "value": "T1162502423504D1D3F6180B7699BBDA750BA53E9EBC4486CF7284BF8F39F2605501BA0E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658421387, "uuid": "adfa0549-8144-4ceb-b927-c09d65ebf662", "value": "f10e4da994053bf80c20cee985b32e29", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658421387, "uuid": "aa78970a-479b-48a7-81b9-6e1eb2f62e98", "value": "12288:qOjpRtSUQh0j0zzEQvSA/1X5jUkbjLJJqkZd7DQpD2FeUCIoUYsqx4+S:qO1HSUQOQvSA/deynPq72mRHJS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658421387, "uuid": "1deac47a-0449-4830-87d4-2d69c4b66d55", "value": 987408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658421387, "uuid": "17af0676-994b-4b87-9af5-5bde832f4f14", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658421387, "uuid": "6a861ec7-d4db-4b60-9807-4d1ae3de85a6", "value": "SecuriteInfo.com.Gen.Variant.Nemesis.9233.11371.24255", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a0ecec7-092c-11ed-93bb-42010a9c0043", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1658432134, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658432134, "uuid": "26beded1-b8f3-4ade-b111-c8245c56ff17", "comment": "Malware payload (SnakeKeylogger)", "value": "da420531bef6206edfbe9ed5548bc250", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658432134, "uuid": "7609fdfd-f874-4a1a-b8e6-e60b29c24378", "comment": "Malware payload (SnakeKeylogger)", "value": "2c7d5f97a2587d945a38d665326817bfd74454a0c22566a9c40ed5401f6e453a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658432134, "uuid": "fbdf98cc-85b4-4b0d-a02a-7bfd63069ebe", "comment": "Malware payload (SnakeKeylogger)", "value": "3f9231506f0b31c276cc1264eb1821ec450cdc77", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658432134, "uuid": "47ff0e10-1591-4d20-982c-10320bcb001f", "comment": "Malware payload (SnakeKeylogger)", "value": "50caaf0eabeecca3642126575c259371dcfeb606c3f4cd1f77bbfb9bcdb8c3c1f1d302992afc02c9c8f015fca2a74557", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658432134, "uuid": "f73d398f-7aa2-4580-aaf5-4f5e137be1df", "value": "T1D8E4AF197627CD03C1BC03B7C0C2544497B18945E16AE78B7ECA22DA1B477EA9ECD78B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658432134, "uuid": "4af9611b-16f6-4c05-b6ca-374002a7183a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658432134, "uuid": "ba38c698-88e2-457e-9c97-9a4151722f5d", "value": "12288:+JCj0fGu31hutVmiD7btZhkEXpAOQRhAV7:PTKutVmi/btbFZAFMV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658432134, "uuid": "3a301367-9ab6-4b6e-bb6f-09a446c72097", "value": 678912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658432134, "uuid": "03413b3b-ab61-4d30-b444-e1276694e6b1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658432134, "uuid": "e1732c84-f061-4e6e-a11d-932825e050b5", "value": "da420531bef6206edfbe9ed5548bc250.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47a8fab0-093d-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1658439431, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658439431, "uuid": "7bf0f3bc-8d1b-4515-a03b-959dff63de2e", "comment": "Malware payload", "value": "b151d0c79f32758e51fc3deaae8d160e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658439431, "uuid": "b18372d9-b787-4ea3-89e6-63e8fac14004", "comment": "Malware payload", "value": "2c8f1f62d57e6d36c840fc24c6366d5ddc4f5084c0ba6abfa8a5db059c7cce3b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658439431, "uuid": "bbbf8e53-6ab9-41db-a3c6-13d94e402818", "comment": "Malware payload", "value": "e60ae2a4565ca64dc16aac7d02ba1911e510c79b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658439431, "uuid": "9986eb88-87b8-477a-8f32-326c06ebbde3", "comment": "Malware payload", "value": "f081cdcbd50dfba9e304e56aabca93a71bfda2250fd880cc2fb7653cf628d113335f0e1471169b94ce40a0d338ed266a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658439431, "uuid": "88c31496-ced5-439a-a962-b553b8bcc534", "value": "T1BB52A74BD3C8D572C97A4A3E584192B20264B351DCBE9F6F34787917B9333C206A2D6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658439431, "uuid": "61b46516-ad3f-46e6-a779-dc86a98d0603", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658439431, "uuid": "bf656236-856a-49b4-90bd-9655dda36b6c", "value": "192:voEQgrgrh+NJTAtYhI6MzAHRJJZYXx6JzSt9f:gEQgrgrENJTXlMMHR9xG9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658439431, "uuid": "c3efabd0-3801-42a5-8b76-af3b630840e6", "value": 13824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658439431, "uuid": "17cab849-9b39-4954-9868-a9f05616d73c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658439431, "uuid": "05f9caa2-af71-41c3-aa9a-651b7242bda6", "value": "SecuriteInfo.com.W32.AIDetectNet.01.21175.18301", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4013df86-08f9-11ed-93bb-42010a9c0043", "comment": "Malware payload (RedLineStealer)", "timestamp": 1658410213, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658410213, "uuid": "ea082c38-fa16-4c94-8796-91c000a40a0a", "comment": "Malware payload (RedLineStealer)", "value": "8b5aaa7509fdbb023fa6105df0201eb4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658410213, "uuid": "2a565536-74fa-44d4-919c-259f6e72e1ba", "comment": "Malware payload (RedLineStealer)", "value": "2cbb7e317e749e0f4d7de7fd084f2217ac91bf13eeee072c004dde01b4c39b8f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658410213, "uuid": "8e36d4b7-f043-4f7c-8fc2-9152dde56b04", "comment": "Malware payload (RedLineStealer)", "value": "107028420189d0bae6f45df288d65306547fbc0e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658410213, "uuid": "37941bc9-604f-44a7-95c2-75bb2f46f031", "comment": "Malware payload (RedLineStealer)", "value": "0009fdf233c5d8c7800959f9951f7e40fda7848be857590408240ed7083381a8fca76af1ad7adf3b7ea6412e7dc3a84f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658410213, "uuid": "d26fe501-ec0e-4f8f-b157-45ebaf7acfea", "value": "T182251239B54145B6C0510979881FC3B6B43AAB105F3C54CFB7ED0E2C4E3735A6AA62EB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658410213, "uuid": "fa4449fb-c3ea-4ee9-a101-5af8d0dd58b6", "value": "c9adc83b45e363b21cd6b11b5da0501f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658410213, "uuid": "aede3390-e980-4d25-9cef-edeaa2e38587", "value": "24576:pAT8QE+kGSg8/KxclHiRKeNsqW8050O9N3H/K6xLG9Lwm2J3:pAI+r9UmUkAqG9N3HtxLJ1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658410213, "uuid": "e3474456-5089-4ee3-80e9-425b78872e69", "value": 1045694, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658410213, "uuid": "c6188bcb-6fd0-407d-be4f-b044d9df520a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658410213, "uuid": "62e9ccde-037d-41f0-833f-840bff29dce7", "value": "8b5aaa7509fdbb023fa6105df0201eb4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fed226fd-092b-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1658432008, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658432008, "uuid": "4269bbd8-ef95-4ace-9cb2-b72e0b728c0e", "comment": "Malware payload (Mirai)", "value": "65596905476da228bdba9d5227b2fa28", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658432008, "uuid": "f6a69592-8067-465d-9a57-fff2d5a96973", "comment": "Malware payload (Mirai)", "value": "2d3b17730a6ba8dced4a32d0228402e883d0be0f1c1e9fb1788892db0762cbaf", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658432008, "uuid": "36da6a6a-32dd-478e-ac36-e60b7f798876", "comment": "Malware payload (Mirai)", "value": "37dc8d23828e31135fb1a250b9a12b33b21449c9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658432008, "uuid": "ad02dbab-274d-40fb-8274-c2cd13ebde7a", "comment": "Malware payload (Mirai)", "value": "4985aa9abc14ade91902e9771c9b61328f33cd21f4a4ec9dfab78e49162cd3f3eca7911913d9699228850b8405f8d95f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658432008, "uuid": "0d85c95a-037e-4ab2-b9d1-28f45f9df4ba", "value": "T1A6735B24A93A2F26C1D4A17E62FBC321F1F6230E25B4961C7CB60F8EFF1465464562B7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658432008, "uuid": "1f1e12bd-b5c4-4faa-8d28-c70c84288380", "value": "1536:ubHmkTSo3BOIqS5aq+Dc035R9QuEk6vNNicKzfsFx8:kmcjaq+Dcc5J+vN4Fzfg8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658432008, "uuid": "44ff1412-b4b8-4b00-9d04-9559c34b7470", "value": 74572, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658432008, "uuid": "c629ffaa-f743-4432-94f4-fd113e5c89c5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658432008, "uuid": "822ef5f4-71ef-4f74-b548-7b1eec3c4f41", "value": "65596905476da228bdba9d5227b2fa28", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3f36412-0927-11ed-93bb-42010a9c0043", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1658430245, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658430245, "uuid": "3b2c6da7-b0a4-4d0c-9413-a91dde1ad564", "comment": "Malware payload (SnakeKeylogger)", "value": "ea2435d1540c808d30d915a91add6fa4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658430245, "uuid": "3f88278c-0dda-45fb-bd72-4a5fd8741c75", "comment": "Malware payload (SnakeKeylogger)", "value": "2d4807b948984f8b7f170d662a8c055f53420770e82428a9315001d3d420d610", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658430245, "uuid": "78c55a25-112e-4ae9-affd-ddbe657f701e", "comment": "Malware payload (SnakeKeylogger)", "value": "fece436874b4478d0cdeb75313a8d10a53980826", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658430245, "uuid": "f9003439-62f4-438e-8b4e-b129f35e2be0", "comment": "Malware payload (SnakeKeylogger)", "value": "1e3d7d81a1fe15e045b9d4aca745bc2f40d3c55fe12ec333b9f897a18b30a05a05dea537669fe9b6503341be694c73c2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658430245, "uuid": "3813a899-05d9-466d-85b5-8b63deff0af9", "value": "T1CA05127322E4F321C93447F2046367881BF3620D3475E16D18AFB89A89E5BD96B127E7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658430245, "uuid": "463aec6a-661a-4a2c-988d-f628176c34e7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658430245, "uuid": "ba6018c4-613d-4c09-ab23-a764f11c5d6c", "value": "12288:psrBFjJEAJF5khhdc5PGrtD2u10JheK/mijTc7vSLEu3qx8c31h:QF1bk/DDLKheK/1jTyvSLELxz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658430245, "uuid": "69c92aa7-e51d-411f-b36b-01c1f5c47630", "value": 800768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658430245, "uuid": "0e95623a-0472-47ea-8a6c-67bb60344273", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658430245, "uuid": "71b7379d-3c59-481d-88c4-b592daacc818", "value": "po-221524.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "276157eb-0928-11ed-93bb-42010a9c0043", "comment": "Malware payload (Gozi)", "timestamp": 1658430358, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658430358, "uuid": "04fc8bd0-25fb-448a-8e3f-e626f6f77cd1", "comment": "Malware payload (Gozi)", "value": "a502b19464bf8f05c9baa64bf745990c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658430358, "uuid": "95568889-f22b-4e5e-8dc4-50492e7223af", "comment": "Malware payload (Gozi)", "value": "2e72775b5e0cc560385c0212813156ff451543d6347ee0c1cce8c30221465bee", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658430358, "uuid": "cea8376b-de09-46fd-86e4-4bc0daca0aac", "comment": "Malware payload (Gozi)", "value": "865d00286a3186d646c142a14b4f98483c1c982d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658430358, "uuid": "578771a5-ab69-4aa8-a45f-51b8ee741c37", "comment": "Malware payload (Gozi)", "value": "55b6be83292d4b9d5b2653b8e7ad9d7769663fc174925234c2e00fdc0b6f6a9eb27fda3f66eecba16dba89407edbba4a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658430358, "uuid": "839a6ad8-eefd-4857-b484-e86887e4cc2e", "value": "T1DFF1D61997C80552DDBBABF7B87366A80364F3214CA3961F28D611363D522870772776", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658430358, "uuid": "40fba82a-a0b6-474e-b241-f466bd524eac", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658430358, "uuid": "e28f0c3b-2ce3-45ac-97d2-69de3bfa91ad", "value": "96:hTCJT8D8vIdagyXt/dQbOUHAxQr121RlIV/0lMEqZN9SMtMJM5OGZzNt:hTCtmCgyXkOUHCQrgBsZNEMEqXb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658430358, "uuid": "5c74551c-8412-48ed-a4a0-fd231b55b778", "value": 8192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658430358, "uuid": "f69e203b-96c3-4600-aa6f-3ebf49fbfc44", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658430358, "uuid": "b8655d21-d2e6-4aa7-a47f-9e3861fa1573", "value": "a502b19464bf8f05c9baa64bf745990c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0e050a6-08d2-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1658393679, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658393679, "uuid": "225fcd13-c749-491e-8f53-04f03346748d", "comment": "Malware payload (Mirai)", "value": "f5e212f38b4bda9fff12913b91bfe326", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658393679, "uuid": "0e4d4142-bace-4f1c-a850-ffee9a535bfc", "comment": "Malware payload (Mirai)", "value": "2ee5fc8e3ad6dff2be3fb38edebb08a5e12e163af4a6cc82fb854e450c68490c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658393679, "uuid": "7813ed1b-f82a-4e93-9b7b-4af854253421", "comment": "Malware payload (Mirai)", "value": "5370c017ad23e498d21ee84377988d85fc2ea430", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658393679, "uuid": "b3649726-e54d-412d-8deb-aca40bcc4d48", "comment": "Malware payload (Mirai)", "value": "26b30e0cc1da4802cffc15060796648fd65da994129b3f5c37bccbc1995e0189733c06e45c60ddd5cbca6b135d133795", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658393679, "uuid": "b5605e53-3971-4cb5-9032-941a5e1dd3de", "value": "T18923F95AFD409B16C5E016BEFE4E428D33231F78E2EE32029D157F346B9B9594E2B841", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658393679, "uuid": "7269c937-a377-47f4-955d-05d466eeb9cd", "value": "768:7FnRyl79nHn2sz1mjzcnpPsESubH3ZOQ6/gXaLg5K1ZOoHmbUZlVueR:7FnY2+1mknZJSubpO7/gwCMOFUZlVu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658393679, "uuid": "9099b133-ebf5-4c69-b79c-a4e6d699b5b3", "value": 46896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658393679, "uuid": "1631dcba-6d07-469b-8945-1fa85d63a68c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658393679, "uuid": "f7cc9630-e989-4ba4-9372-1a19e4520d0e", "value": "f5e212f38b4bda9fff12913b91bfe326", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ae0284a-08f9-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1658410285, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658410285, "uuid": "d085c92f-c018-437e-8a55-d1fee00bf3e1", "comment": "Malware payload", "value": "12b4d2c757ec9be0baf306d9da6f515c", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658410285, "uuid": "a97fc136-07a7-4e4d-a259-07f8ebcc13c7", "comment": "Malware payload", "value": "30197f2749e9bcbc23531d80c6b3430eb62c7d0e58495521ea3ae16747f412e6", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658410285, "uuid": "38267046-ea58-4a71-8565-1943da82b71a", "comment": "Malware payload", "value": "f97e831384a62cc4ab6fb862bfd94fba42aa880b", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658410285, "uuid": "adb0ce79-a357-429c-9d4f-d46de4e58e16", "comment": "Malware payload", "value": "c51307ab60465cea14dec900727f12149e558df090f245e7229df819952bc4fa9a89241fbd8f6e019b38a0b56396994e", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658410285, "uuid": "12929c5f-8133-4d70-9db2-1f00c760f821", "value": "T19305BF93F3E640B9C0AB92718E16671BEBF1B80A0134D74B57D49EE52F13B62672E311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658410285, "uuid": "24a09ffc-d5f1-4036-94a2-8c7b841c1a3f", "value": "2580676c6bc8cc004118bc7178886d83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658410285, "uuid": "7f961fa5-ee7b-48df-b70e-af0220b8a0ac", "value": "12288:hgW9dEX5PQgm3nXAl80D7Rw5jSD8A4LRmmaJ5WvIcqgICTR6RB2JiIoHxXmwNDLd:iWi5YF3Ud7/DrjHWwcRICTkBIoR2wI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658410285, "uuid": "064e3cf8-816d-4026-9d03-91f9c01a5f4c", "value": 803752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658410285, "uuid": "4f900f61-b4c2-4c57-96dc-f4bd980fa6df", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658410285, "uuid": "c7d84891-e9db-42d3-b54e-800c619c9be3", "value": "10496c58.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2621cba4-0929-11ed-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1658430785, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658430785, "uuid": "ad173606-b16f-4de2-88a7-db7b57559f3a", "comment": "Malware payload (Formbook)", "value": "275e1f26dd9423d6c08eca401c5a53bc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658430785, "uuid": "e2b8696a-db58-434b-b144-54f4f46b36be", "comment": "Malware payload (Formbook)", "value": "303552f2101e6df22568d99270caf3b19e86d2f3191631dc18a4328e129687f2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658430785, "uuid": "c13c600e-9b12-40f9-8cf5-3fa3288d1932", "comment": "Malware payload (Formbook)", "value": "329be7cac31977359c999540a487e6d1ed7c009f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658430785, "uuid": "82dbfb9b-49f6-4750-b4e5-4bfd9f6f04c6", "comment": "Malware payload (Formbook)", "value": "ac9fa2fcdf222e85fa44046287f9b4fb13f99df27f550e6ffe9a1c7c3a8c4816edf36bc71a84101e6f21478a4bd48cc1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658430785, "uuid": "53cd1bcc-e5d8-4823-90c4-a946af6fe0f6", "value": "T19FD4023771E6E901C13457B280E3569817B2A20FB4B3E21F34DE61AA85D63DB9E807D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658430785, "uuid": "7139ace7-870b-48aa-a2ef-cf2a761d5405", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658430785, "uuid": "d178c4d1-2151-45e8-b5d5-73855a5b8396", "value": "12288:somgg31h5x8n6tmzaUpVjqDGGUD/gApsNK3GO:a5xfq36CxD4AV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658430785, "uuid": "dc5b56ae-6465-47e8-9f4a-3394355c9668", "value": 627712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658430785, "uuid": "71f1bfb5-ff2d-4ac2-9222-50f06cf70fe8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658430785, "uuid": "9b3cb88b-6f3d-4cfd-b676-3b629966b378", "value": "Ziraat Bankasi Swift Mesaji.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1873d360-092f-11ed-93bb-42010a9c0043", "comment": "Malware payload (RedLineStealer)", "timestamp": 1658433339, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658433339, "uuid": "2d9ae9e1-84ff-4e8d-b8a5-0286cca276aa", "comment": "Malware payload (RedLineStealer)", "value": "644c124d9e5cf865fb75bdb3ce8d13d1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658433339, "uuid": "1d67f049-6108-4c4f-9f4d-2c38e20b0ace", "comment": "Malware payload (RedLineStealer)", "value": "30528f2a9ca10a996d5aab72a69b77635328ca16983461cb55f22fb5b7ccf6ec", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658433339, "uuid": "fc1de2d6-9058-4611-974e-14cb35d97ca5", "comment": "Malware payload (RedLineStealer)", "value": "542532dd76037f6fd8b0c60060d1796ac8110790", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658433339, "uuid": "eae7cb72-0d07-4dc6-82ca-5a08ece0c2e7", "comment": "Malware payload (RedLineStealer)", "value": "c8bbaca02f8b6257eaeded3212b569128d312a390c2bfcf1b69230c754dba72e6218e5c30ab1c8a4b0513e538bdd3991", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658433339, "uuid": "1386a5f2-3267-48d4-bcb2-af0415ffd1ba", "value": "T1844423BDC7F8A615F99FDD70F19A1E74123104BBF8EDDBB66405018227F20486EB59A0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658433339, "uuid": "8430b27f-2e84-4ac7-a3e1-f012b567fd0f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658433339, "uuid": "ae53a3ce-16b2-4f8c-bfa7-83060432f7d4", "value": "6144:RpxoGyWXb9XJYD7Bw32iIzw8xZSZN3m5VM6cdIkOBG:nJk7Bw39Aw8x8mE6WIkO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658433339, "uuid": "52962bf9-2dc5-48e1-a22c-93abd1ed8308", "value": 269824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658433339, "uuid": "5e270455-1576-41b1-8132-5377e049c3bb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658433339, "uuid": "5a18e210-9dab-4bdd-830b-6068e93e1ee1", "value": "644c124d9e5cf865fb75bdb3ce8d13d1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01da9e61-08c1-11ed-93bb-42010a9c0043", "comment": "Malware payload (XFilesStealer)", "timestamp": 1658386057, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658386057, "uuid": "383897d4-0c99-42dd-8eb4-906950c40075", "comment": "Malware payload (XFilesStealer)", "value": "096d603d304ac7fa9d592e5c71144c01", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XFilesStealer", "colour": "#D1E15B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658386057, "uuid": "5b985940-607c-48d0-9d2e-7101ce38c4f9", "comment": "Malware payload (XFilesStealer)", "value": "311e91580719d68dd6908f2550de9c5da033b6127099d8413bac80d0ad9ac25f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XFilesStealer", "colour": "#D1E15B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658386057, "uuid": "d2628127-cf1b-4f91-85ab-80d91e36c5b1", "comment": "Malware payload (XFilesStealer)", "value": "ddba13490764a9b87fb7f954131346f293fe1b4a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XFilesStealer", "colour": "#D1E15B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658386057, "uuid": "5f307adc-8695-4f80-a045-cd32f51dc5dd", "comment": "Malware payload (XFilesStealer)", "value": "f75662dce7067e3ebee7446500e8a54d3d9c7822b5c280a4ec11908769d208f537ca9ed7e7cf03b4e8070f45ccc4bff3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XFilesStealer", "colour": "#D1E15B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658386057, "uuid": "92bc491a-fcb6-4df0-98fd-31a4d2d410b1", "value": "T1333633058B08453AECC46CFB6E4AA723B4761B9C7FAF09D532865F47B909C6A43C57C8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658386057, "uuid": "f2c83987-e1e1-45f9-81ce-c21a3c8a1309", "value": "98304:7XEHP+LCbgFUh94HAOemfL+hSj2+LsCgC7+0Ut16a6R2vmWOnZkcidrimHd30Vwn:7XEvY1C4gWfyhQ2+ACgVBya6EvmWsqcw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658386057, "uuid": "5c2abb90-76a9-4a67-9713-9e3be03e2740", "value": 5223424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658386057, "uuid": "bf561479-02b6-4d45-864e-7fa715b60eb3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658386057, "uuid": "21c19fd8-207b-403b-bb89-a564ba3e9d54", "value": "096d603d304ac7fa9d592e5c71144c01", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1fd889c-08c8-11ed-93bb-42010a9c0043", "comment": "Malware payload (Gozi)", "timestamp": 1658389439, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658389439, "uuid": "d86c13b2-e16f-4444-9a8f-f703f796a86c", "comment": "Malware payload (Gozi)", "value": "c9e37091453009a6de0d093934e36198", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658389439, "uuid": "519b513c-f7f3-4a93-bbb0-11e82d2e096f", "comment": "Malware payload (Gozi)", "value": "314c3ac534ed003c635b2a3d002023288fbc59b93bb849079ef1e348cf97a93f", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658389439, "uuid": "2846b7dd-4919-47e9-af46-44116b6140c7", "comment": "Malware payload (Gozi)", "value": "9e9631840783c98cc70a09944e1c520a8848d8fb", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658389439, "uuid": "280afc9c-d7f0-40a7-99e8-de538568efd0", "comment": "Malware payload (Gozi)", "value": "5829746ca90b40efc0d516355e3294156bb85b01950385c365d67d5406c6a791db56019bf9e9def1f939ae22ed146760", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658389439, "uuid": "731d9f43-dc87-49a3-bc87-4b24980ac2f7", "value": "T146B4010F0D445ABAD2A349755CBC27A80F95C854C34842EB979B8FEACA1E9D0C5BC53F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658389439, "uuid": "2109090f-3339-4933-900c-9c6a7afdaf83", "value": "3ff33416b3c4907a1caa8d7f99b5d46f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658389439, "uuid": "db25c321-62ea-41ec-b45d-77e7414b75c7", "value": "6144:rm/VKVkz5d1knAPthkMGQ26ATHnMqJeW7B/NpJdgUqHWM607:iNEkVd1pthkMGQ2LTEW7ZNhgpWM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658389439, "uuid": "7354e904-1dbc-4a3e-b685-74736d027143", "value": 528384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658389439, "uuid": "ce56f3a3-bc79-4d1f-98d4-ae330cf558fc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658389439, "uuid": "b8249e9d-6187-4f46-bedd-c88e036bae6c", "value": "c9e37091453009a6de0d093934e36198.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04753b0c-092c-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1658432017, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658432017, "uuid": "f232de30-fadb-4881-8844-63b8cf7d6fd8", "comment": "Malware payload (Mirai)", "value": "329ea5e726e205c6bde8d2fedb7551fe", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658432017, "uuid": "80f4569a-3222-404b-9460-0209264091c9", "comment": "Malware payload (Mirai)", "value": "31603a70e482a6daf36616158102418cad64ec41d9bc58f493b65a1f997239fd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658432017, "uuid": "1bb9ea00-ca10-4e11-a2e4-2605d3feb521", "comment": "Malware payload (Mirai)", "value": "0204ec413f7e762ae8b7dae747c96a94f83fc50c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658432017, "uuid": "3b5057bd-9846-4ac9-9fe0-c7880af2aa8a", "comment": "Malware payload (Mirai)", "value": "3cf33055088b0315cb7b1ce239e2b1084b5e71718988237cefa6da7929ecb989baf0991f6f29f8021d6b7a756670a32b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658432017, "uuid": "01194d54-ad49-49f1-8c22-dd1c7d11e327", "value": "T167539FB5C5A8BD99CF698278B61488389723900565E33DFAE741C7A6D00BEECF00D7B1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658432017, "uuid": "382a40f4-3a45-4209-9bad-1f5b8bedc2f5", "value": "1536:B/bivQhunGauwt4IduhosjT1RYeycfs3QtLok1cY3CJia:BjiBGFOdOT1Rhf+Kn1cY3m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658432017, "uuid": "4045c26f-bcfb-4937-9611-912238c955dd", "value": 64348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658432017, "uuid": "a1d93fae-7445-4f04-97e8-aa18534dbba1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658432017, "uuid": "48393ac4-fc80-4e92-9da8-7514301aaecc", "value": "329ea5e726e205c6bde8d2fedb7551fe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0267590-08f4-11ed-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1658408334, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658408334, "uuid": "0120422b-8c74-4de8-8a5e-1dbc3b4fbdc4", "comment": "Malware payload (Formbook)", "value": "d7b6de9eee0391cdd094952bf72dd483", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658408334, "uuid": "4e3c9822-8cd5-49d4-a239-2be30de7ac03", "comment": "Malware payload (Formbook)", "value": "31f21e3ba94e074d03b416decbbb5a69994ccd8137b3e361acf21e298c00befa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658408334, "uuid": "c9d71787-833c-4e6f-a054-b88ecb2b9c19", "comment": "Malware payload (Formbook)", "value": "7e3973363f560d9b9afff330f8085ac906a40f73", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658408334, "uuid": "c8a6f668-7297-4adc-890c-5753957f142c", "comment": "Malware payload (Formbook)", "value": "aea3e7d30df73d5b5150ec07492bc48f0775aea270560b015af50a693b557a3efa06f4539525a3b55c2ff6cb6e77229a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658408334, "uuid": "4a0ffc51-5a2b-4be0-97e9-54a940ea523a", "value": "T13D02D922B7FC8B75D8B90B715CB6A742067AB7569913DF7E29C0000E5D82688CBE2771", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658408334, "uuid": "d8389e21-5acf-445e-ab86-ffc8bc7d58b5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658408334, "uuid": "faa890f7-ab38-4ead-a654-c1226f559088", "value": "192:LQxDxD/EBIQFCPDJCeePYiqV++De5vcm3:8/DcBjYJCdQhE5vcm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658408334, "uuid": "8d90c96e-9d22-4b44-b6ae-e900e3e64c49", "value": 8704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658408334, "uuid": "8699f49f-b182-491e-9e5f-9273b929548d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658408334, "uuid": "5031f03a-cfd9-42d4-b11a-b08e7bc7a5a8", "value": "Original Invoice_12_1421-07-2022085 Document.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11f3c1c6-08a4-11ed-93bb-42010a9c0043", "comment": "Malware payload (RedLineStealer)", "timestamp": 1658373628, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658373628, "uuid": "49ad0c0c-c085-4fc2-b649-d7bcf3d558b4", "comment": "Malware payload (RedLineStealer)", "value": "63c834243d4c6aab3d6a4f56c2a7db81", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658373628, "uuid": "960bb793-c152-4d62-a342-bb2f85ae5a59", "comment": "Malware payload (RedLineStealer)", "value": "32fe263a8ffc6bc490c545d6394638347164e676a79e537037f8b0c9691194ef", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658373628, "uuid": "d957ab20-ac5d-4a4f-a520-4fdcaf9810a7", "comment": "Malware payload (RedLineStealer)", "value": "28d26656406e9f9767b305a6a6397f7d75253de8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658373628, "uuid": "c109178a-017f-4cc6-95f9-98e145d82ff5", "comment": "Malware payload (RedLineStealer)", "value": "62e9df765d303a348420028ff150b2e67bb6acc4a9db781a40ef5087107ad9704d2727dd529b09fb63d9e92a2aa75618", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658373628, "uuid": "fcba1ea6-2c0f-493f-8fc5-189da1975a91", "value": "T1B8752335914581BAE5B21935895BE2B1B23BFB041B2C6C8FB3DD0C59ED233061E7639E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658373628, "uuid": "fef22362-0579-4298-983d-13abafb5dbef", "value": "c9adc83b45e363b21cd6b11b5da0501f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658373628, "uuid": "f0a6c5a7-c796-4279-b022-4dc5883df66f", "value": "49152:pAI+gKkhmqYFjX1aC4BLwD8PZXuCE7036l0PJ9+CK1g:pAI+ZDjX4C4VZ+z4MW9gu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658373628, "uuid": "6f26b352-d836-4555-8668-d7c9bf82e2a9", "value": 1675215, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658373628, "uuid": "19469712-8595-4e55-9b8c-694d5480247b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658373628, "uuid": "54eb0d55-2810-41f8-9567-fb1dbcd463c6", "value": "63c834243d4c6aab3d6a4f56c2a7db81.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "792e84b2-089e-11ed-93bb-42010a9c0043", "comment": "Malware payload (RedLineStealer)", "timestamp": 1658371224, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658371224, "uuid": "47f987a2-afda-43da-88e8-f926d1ad77d2", "comment": "Malware payload (RedLineStealer)", "value": "ec5307cb8b05f359e325721d9e1c2b1c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658371224, "uuid": "0c66670d-5ffd-4e30-8e08-076a6d13b118", "comment": "Malware payload (RedLineStealer)", "value": "34211e5c3790f76a96eb915fc89ec3fd9c179c2138404ba994387dc5903f575c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658371224, "uuid": "4533c8b2-d3a8-48e6-88c4-03ba6147f3de", "comment": "Malware payload (RedLineStealer)", "value": "49c7fef2b38a738d085651bc503cdc0a147d6a2d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658371224, "uuid": "60ca388e-c10c-4ad5-a264-9404184d79ff", "comment": "Malware payload (RedLineStealer)", "value": "ae7801ed501a0f0fdc0528695a01c5a2ecca341de2a058c4dc62bffa3677d6c7be1f4f32e44e5eccb0fd77056e96c260", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658371224, "uuid": "1ec5e5f7-9340-4635-bd58-d8600e0f5a68", "value": "T1F225123AB181457BC0220A35485B92F9753AFE045FBC64CFB7DE0D1C8D232556AA63EB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658371224, "uuid": "5fc63fb7-21ff-486f-bd0e-cc44df104188", "value": "c9adc83b45e363b21cd6b11b5da0501f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658371224, "uuid": "f49561ab-a0a2-4c28-9a81-18f2c8e2283a", "value": "24576:pAT8QE+kiSg8/36Hovp70Uqe6pBEsB6paIHFAlE1j8ZBzb3O:pAI+r9UKHsl3fsB6ppHRgP3e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658371224, "uuid": "f1b6bfba-0e8a-45a6-b446-fd7d1dd69165", "value": 1042870, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658371224, "uuid": "5c9a5bc3-b14a-4e9d-9681-f66bcf8ed32c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658371224, "uuid": "da35e4ff-5f7e-4d70-a5c7-c83edf927aba", "value": "ec5307cb8b05f359e325721d9e1c2b1c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9e331e0-08cf-11ed-93bb-42010a9c0043", "comment": "Malware payload (Loki)", "timestamp": 1658392351, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658392351, "uuid": "5a6da6de-4382-4b1b-b133-79514b18a37b", "comment": "Malware payload (Loki)", "value": "02dbd3ed46663a73304f68cfa0b7c24e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658392351, "uuid": "2dce043a-5e96-49cf-b665-7ac63a564fa0", "comment": "Malware payload (Loki)", "value": "3433d90cbaa8fc839ed9e30a97ad6d2c39d39f03b784aea8bf3aa5805d1934e4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658392351, "uuid": "480bf63b-4057-4b6c-bce4-453acb61a2d6", "comment": "Malware payload (Loki)", "value": "5377c02848ff1c2d17523cfeaea517ee58c2487d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658392351, "uuid": "c839e1a9-625b-4c2b-823d-a92e4044f2de", "comment": "Malware payload (Loki)", "value": "0d377c502d3d7d5204725d924fe4ae33990ee0fd006f2289a6fcf619c3a3380c678b5152a49073d679267e89e216e185", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658392351, "uuid": "8a598891-6f60-4535-89d9-3276e15a4c2e", "value": "T16BD4AE14B62BDD03C27853B7C5C3505453B04906A12EEB8B6FDB22D62B427EA9DCDB87", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658392351, "uuid": "fde0516d-b56b-4a2c-b314-04572342240a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658392351, "uuid": "75561d36-0f98-47af-aaa6-887e0af31efb", "value": "12288:RMIwy7qG31hovUEgFiaLKAmzCxKdklFWwT1W:SAZjYgKAmGx8wFk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658392351, "uuid": "8c1cb0ab-0c96-49b9-8765-aae5e9a3d0fc", "value": 647680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658392351, "uuid": "7a7b45a4-b345-4f41-88e9-a313a4c8a05f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658392351, "uuid": "2630361b-1106-4594-998e-6e1e64dac157", "value": "DHL-21-2022.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9eba832b-08df-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1658399205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658399205, "uuid": "18805888-bfd5-4f4a-8c0e-beddbd5c3135", "comment": "Malware payload (Mirai)", "value": "7582f8276df253946bb3057ba3aa40a2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658399205, "uuid": "0deb2b9b-88b6-42c6-b558-23e05eaa95f6", "comment": "Malware payload (Mirai)", "value": "344a9ac4e354cf5195440d6c3245b71ea2aa6677e1e1c7c7b471919a6c72b70a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658399205, "uuid": "9ee5bc16-d70a-4909-9477-32eb3002fbe9", "comment": "Malware payload (Mirai)", "value": "5cca1015d35e27e18a3029d21444f5c1e1a1882a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658399205, "uuid": "83e0887f-ee9a-4944-bdcc-47a87d94350b", "comment": "Malware payload (Mirai)", "value": "ff7258e9af8a80bba52644790b8fda0d4c308731612274cebb5b373078842fcb3731c7b2c204b96b86c18dead675395f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658399205, "uuid": "f56c50a2-3f61-4a2c-a4e5-c395e634d09e", "value": "T1AB031956B8818613C5D5137AF6AD468D3B3467D8E3CF3313AE222F613AD681B0D67E84", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658399205, "uuid": "8729252a-eaf5-4ec8-986b-bb74fafc9beb", "value": "768:Od/RrrF0mTX79wyOrIHcE2y/QF28xo4mWQfwT:+RamT5JcE27F2vcT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658399205, "uuid": "12be3ec8-09af-40f1-898d-6860b53422ac", "value": 37884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658399205, "uuid": "ca5ccc0d-410b-4192-8468-f05109726f47", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658399205, "uuid": "2699128a-6e0f-4985-97ae-f68f2192b966", "value": "7582f8276df253946bb3057ba3aa40a2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27c2bf01-094f-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1658447109, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658447109, "uuid": "0bbc2919-e707-4098-89b3-d49fd356b329", "comment": "Malware payload", "value": "ebbeb56414bd60e4198ef2f29ca4465e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658447109, "uuid": "6f5dc228-d850-4892-a4b6-61c31fab5120", "comment": "Malware payload", "value": "352eb5d636ad87a61ea9e461cb9ded8d45981e4b2ea05f025595b0b7c8830644", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658447109, "uuid": "0559a1f2-0c05-4faf-b104-c71c562330ce", "comment": "Malware payload", "value": "6c314a5c0c62f108cb415196629dfa52b67afc14", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658447109, "uuid": "3dcae907-d219-4c22-ad9d-63e402955ff7", "comment": "Malware payload", "value": "7bdbea521e46f1b53cb7016e38e4e9b374d2c4610a798e893d27d0f4a5f8e14e30951a667a272c3f327801f12717e989", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658447109, "uuid": "520d30b9-7770-40d5-9c18-fd28adfd8b77", "value": "T11AA4022929D83B53D885F3F18A22EB390652DE147411238D98B57C579EB1A427A3F33F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658447109, "uuid": "34583877-c465-40d1-9f51-17bee9dca453", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658447109, "uuid": "c1d54d06-62f4-4840-bf2c-6761f8f2b3b7", "value": "12288:czrHTfbdhkf9hRqaDAEvVG//rypNBie7Z9pJSIJl:MTDdhIUqhVGHrypNBie7zvBr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658447109, "uuid": "3862a2db-9aa5-4522-bc56-faa452c353ed", "value": 492544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658447109, "uuid": "e17356bf-acab-4219-9355-cbb679b89641", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658447109, "uuid": "b08d5be7-b867-4e21-b882-e97e8dec0fb1", "value": "SecuriteInfo.com.W32.AIDetectNet.01.31429.23525", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87cf6dbb-08f1-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1658406897, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658406897, "uuid": "3f212c78-2813-4c7e-a6d6-d4f973818288", "comment": "Malware payload (Mirai)", "value": "d72609a911cb7a9f67623ae048fd38c3", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658406897, "uuid": "b8c9a3cc-5289-4a10-b95d-42ea1bbed594", "comment": "Malware payload (Mirai)", "value": "35b78f7e9066fc1801020e1e3b3a31dfc98d411782c6f1ec79f1af9e693e9e6d", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658406897, "uuid": "396dc39d-01b2-4ed0-ad3d-aa933e832e6d", "comment": "Malware payload (Mirai)", "value": "8ac7b24a325c5404d2af4994c1fbbcee76c81601", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658406897, "uuid": "050fe295-4a53-4b02-baf6-eae6c2c32d33", "comment": "Malware payload (Mirai)", "value": "c5744737a1c7973a9f9951523116cee5219a0994266bb568c53e15f43ed0f7f4a52f8555484cf4d378ebe3fb130a83b9", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658406897, "uuid": "9863e96e-c431-4807-b4ba-85396d60fd17", "value": "T1FEF2F2F52B01C555C688D57107BD07A01AA30DD0AC0BEC5A45EFAF4FDE868686A87FF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658406897, "uuid": "364bc535-d311-40c5-a7c4-78ddb1c50ca0", "value": "768:eKC4jpy5iGmqUC5ffC27LcxbHyrWsuZRBvXnRYAU8TT+mrJgGlzDpbuR1Jg:xTo7mqUCZLcFSev3RYAU8mmhVJui", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658406897, "uuid": "d5fa498e-0153-4919-a052-d11759f67c3d", "value": 37540, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658406897, "uuid": "a51a484d-f822-4548-8e9d-11b3f707e481", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658406897, "uuid": "8a13becd-ab70-4235-b11b-82d2c6751399", "value": "home.mips-20220721-1234", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4755a57d-0932-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1658434706, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658434706, "uuid": "358ba55b-a5a1-4cf0-a532-2b91b0983009", "comment": "Malware payload", "value": "6d9b687c8a05bbb8a1ed4690921dc57b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658434706, "uuid": "9f9255df-b2ec-4302-a894-10b4832bb42a", "comment": "Malware payload", "value": "376aef221d6841ef7f098e1dd1eb602ac12e11e8ef801fc10563f9427f72c358", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658434706, "uuid": "086e224a-adec-4b45-9d63-4a222bfc3a6e", "comment": "Malware payload", "value": "e07995a66f74fadf892af25677b9d4b1632adf15", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658434706, "uuid": "b61f42d4-b048-4608-8d5c-95808824539a", "comment": "Malware payload", "value": "8ffe31141a821cdf8300be1f1d36d61cd6d92509787d510a03b253552604251ea423d7ef579cca0c9af59d444e510807", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658434706, "uuid": "51d0935a-3a77-4186-8e15-117c8d89a8ab", "value": "T1D9F32A09F6408757C1D2277AF68B424933339BA4A3DB33165938ABF43FC2B991E36915", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658434706, "uuid": "e0121ae1-8dcc-4a3d-9a8c-cfd8f7e84fc0", "value": "3072:B49JuaRFKssVOaEA/WFdm4nuImM/9N+RPrv+rB5mewfB68Q27b:B8uaRFKsMOsWF84nutM/9cu5mewfB6TU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658434706, "uuid": "ae87ccd0-3652-46ec-bb3f-53a1d0bf032b", "value": 167421, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658434706, "uuid": "29d3ee8c-8d77-4640-a64a-f8a9eca27c4c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658434706, "uuid": "3b302f60-a3ae-44d6-b782-17b58df8ec56", "value": "6d9b687c8a05bbb8a1ed4690921dc57b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4e8a98f-08ef-11ed-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1658406221, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658406221, "uuid": "c653fd8d-3255-40fd-872b-10bcc6ae690a", "comment": "Malware payload (Formbook)", "value": "3ae77545bac20bbb818266c103eb6cf5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658406221, "uuid": "fc5c7f54-8fbb-41bc-b2e4-6b58aca410b9", "comment": "Malware payload (Formbook)", "value": "37db62e1b147a5ce250a03cc0e44f3c9a032661740c2d4b0f062d7b6ab5c0ca4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658406221, "uuid": "b5adeefe-d9ad-428b-9de7-bbf504f20e3b", "comment": "Malware payload (Formbook)", "value": "04389dcc997ecd9cef3a2fa90076c48fd9ecf7b4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658406221, "uuid": "d1ae776c-d9ca-4f45-b9c2-3cb121a1efa6", "comment": "Malware payload (Formbook)", "value": "659f5310dfbd3f22cb87f050cb59509c4a4922cdeebcf9da0a908b8d28d089da9d00628f09f7e852fb94a05c2c48139a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658406221, "uuid": "ee5adeda-4436-4e03-a664-6b03fcfb254e", "value": "T1C9A4014B8C9B0FE7D0295DF7E8E971CF1108B1A64BF089878AD4666F83488B7711617B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658406221, "uuid": "cb2106a0-7bd4-45fe-9fbf-a5b25a224ff4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658406221, "uuid": "1e0edf26-3907-4da2-ac2b-30e677771659", "value": "12288:ldBWo7x89Z4vSdPS+XNahGrnFARsUn6+jb+H:ldBN7xGq6HNUGLFssMZj6H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658406221, "uuid": "9dd7101a-823c-4099-acbd-4938dd07bb61", "value": 476160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658406221, "uuid": "6c6d123b-f410-4483-9306-bccfd0d998ca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658406221, "uuid": "6a8956c0-ad34-4155-9434-3418333aefeb", "value": "\u00d6deme Formu 0721.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e5ef468-08d8-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1658395983, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658395983, "uuid": "962c5c42-0d0a-4dac-ae4f-555bca52c667", "comment": "Malware payload (Mirai)", "value": "84890b9431340f3e935628f0965f3cb3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658395983, "uuid": "08d31a4f-7645-4fb1-afb8-236a9cfc6c9d", "comment": "Malware payload (Mirai)", "value": "37fef2f1b5646e9268c3ac4b6cd226c85851fbb7d8d13422669841f55587dfc2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658395983, "uuid": "cd8ab3e1-c753-4938-a793-e82447cc307d", "comment": "Malware payload (Mirai)", "value": "4a2435dd0b37deaabadfb2b01240092bd0779492", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658395983, "uuid": "7948d76e-0225-478c-9c16-55dba0979f2e", "comment": "Malware payload (Mirai)", "value": "b44beb4a126fbc3d1ec9c2d2347d48d19752dfc6471d65fbe92827631a24fb187c56300ce410174b7c81da98278114aa", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658395983, "uuid": "9392b9f6-1b6c-430d-9030-51c67c2b0c8c", "value": "T11FD2E170804FCC30F9734DBBD9A5464723AA0D3C81FA7AB92640D6B7B2EE05921F4685", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658395983, "uuid": "b16a86f0-c5d8-4463-9105-89d3241cdda3", "value": "768:yfo4g8FkAF+shq2MbMyR4d4PxDUds3Uozf:8H7kmTGdRtP1zzf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658395983, "uuid": "ff0cddd6-b431-44ac-ae07-421815d02880", "value": 28308, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658395983, "uuid": "b3f6bfe9-b221-4ac7-81da-8234db3539d4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658395983, "uuid": "1ac6843a-820c-45ea-9670-7dc53f956709", "value": "84890b9431340f3e935628f0965f3cb3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e46b01a4-08c0-11ed-93bb-42010a9c0043", "comment": "Malware payload (RedLineStealer)", "timestamp": 1658386007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658386007, "uuid": "84a71db5-690c-41c1-be62-b0dbdf1165fe", "comment": "Malware payload (RedLineStealer)", "value": "2aa6c5cc3696e23095c6757e2502e31c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658386007, "uuid": "0a13c6fb-6cae-4233-a03e-72bf9b7dc9fc", "comment": "Malware payload (RedLineStealer)", "value": "3895f47a248b5448cb581217a18a4e9c99732a2fff98745e2be87e08651d5408", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658386007, "uuid": "b46a5468-1e05-4c63-860b-b829f92a4bed", "comment": "Malware payload (RedLineStealer)", "value": "e41585ef8e5aae420cd997f85e615d54bd628633", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658386007, "uuid": "b69503c8-91de-4e46-a990-3d771609e812", "comment": "Malware payload (RedLineStealer)", "value": "aca5e9c605b910436d8b9572a4008b012d201ee25bfd3156a938d7608cc0a1526e45a24b3e0742b8723162d0ff93abd3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658386007, "uuid": "c2fa7138-fd87-4656-91da-8fe715dcbf86", "value": "T13B84CFF50FDAC7F2E2E73035663A0F168D19D50D0E274626E9BFA18D263D99EB6D2400", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658386007, "uuid": "c95b2b06-5a63-4373-a0eb-589aed7e9ee0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658386007, "uuid": "b45e842c-7aad-4f99-9557-210acb84eb88", "value": "6144:Ae6881awVIWqNAYD5QKEiLX8ihQ65Ut+nbcjJkuPRxVXevrBJG5z:Ae6NarTAYigX8UQ65JbcjGu5D4BJcz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658386007, "uuid": "dcc1471a-aa80-46f3-9eb2-6ba087fabf45", "value": 379392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658386007, "uuid": "1e1e3792-3d9f-4509-a30c-f8f17c4922d1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658386007, "uuid": "11c0e279-5e2b-41b1-bbe2-cdd466ec17c6", "value": "2aa6c5cc3696e23095c6757e2502e31c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d46c8117-0916-11ed-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1658422917, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658422917, "uuid": "80972b1f-1771-4a21-899b-ab3d47850d19", "comment": "Malware payload (Formbook)", "value": "3f1327664944d4f185c83b6fad7d0cb6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658422917, "uuid": "595de590-55b6-4be0-b0a4-cf1238a1b22b", "comment": "Malware payload (Formbook)", "value": "38e704da0f9ec4fd7f487fc129516b220221b59b0841f2ba7ad274d830d4e398", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658422917, "uuid": "6d7c6caa-66e7-4c5d-a808-091db13a8c0d", "comment": "Malware payload (Formbook)", "value": "2e35ab1ca8562f10d45b7c0bd23344cc0a938075", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658422917, "uuid": "64bb981f-6daa-49f6-ab93-d3fb25f75361", "comment": "Malware payload (Formbook)", "value": "c6bf502184b66017f6b7f497429dd4954910ee564e89dcf1ad8b648b2b881f5a1ad59675cba5d8ced091def5e84eba1b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658422917, "uuid": "68e17ab9-2298-46ee-8ece-0206b2f54ef4", "value": "T180049E36E742C070E3B241F5B27C1BBB883E1D35325490AAF3E61AD56EA05E5B46931F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658422917, "uuid": "e2b8848c-20cf-42bf-802e-06897a8dfacd", "value": "3072:JcmkK9D0gfB4FnruxAfP6W1Gat1Y+fF7ZrFho4ZfnqhhJCi2wX/ZQXd1Cq:JcG0dFnixMPsatHt7ZrDo4ZfqnJ72Q/K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658422917, "uuid": "e33b646a-cb45-41b4-a229-e69778a24e04", "value": 182784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658422917, "uuid": "d3a549d1-4adc-475c-bede-0ee8500c542b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658422917, "uuid": "85b9a18b-54f4-4b12-9484-92bbfa231d31", "value": "3f1327664944d4f185c83b6fad7d0cb6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1b9aec0-0925-11ed-93bb-42010a9c0043", "comment": "Malware payload (RedLineStealer)", "timestamp": 1658429409, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658429409, "uuid": "f2408e27-a523-4644-b771-bbe1516bbf2d", "comment": "Malware payload (RedLineStealer)", "value": "370a0551f083baad2d2a25a7faccd2bb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658429409, "uuid": "c147ea1b-3328-4342-b37b-47a70ce6c886", "comment": "Malware payload (RedLineStealer)", "value": "3a776baee8c100758fb32becb5c2fd9064f122864d423de20ebe3cc73e75ce58", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658429409, "uuid": "2b35c42b-2761-465d-ace0-89d4cfc30751", "comment": "Malware payload (RedLineStealer)", "value": "361fe0a8836b0bd9d62cf1d6b5c3a693f0a7b394", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658429409, "uuid": "14183d35-b73e-43ae-8634-358c90ff2d84", "comment": "Malware payload (RedLineStealer)", "value": "736e5ea452053d4d53498fb4430f50d67fcef7adb8a393a5f554e639de4a3a96455046f192aac55d60a1e66520d13b13", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658429409, "uuid": "196f51cb-2f4d-4d5a-afb2-023189a59ea9", "value": "T14454E010F7A3D872E0A6553058B4C7B0AABAB833A570949FB3D43B6E6E702C015757B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658429409, "uuid": "3dd28569-3c2b-4615-bdde-37e89148529c", "value": "401da744a568f91ec17ba84225e05b40", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658429409, "uuid": "c33fa368-f2fd-44fc-8cfb-526865f49cfe", "value": "6144:49Fe6f69ejVJ2pBB5rsMDiomcF6iG5ss7nYYIDAIbPk:sf1jVI4qioVXMP4AI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658429409, "uuid": "9d709eb4-55fe-484c-ab58-3b5e2e28a8eb", "value": 301568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658429409, "uuid": "cee02762-1c32-44c2-bfcc-73cd7f3b8aef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658429409, "uuid": "bef89ca2-34d2-49f1-9d70-e551e18552f3", "value": "370a0551f083baad2d2a25a7faccd2bb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7d42ba2-0905-11ed-93bb-42010a9c0043", "comment": "Malware payload (Loki)", "timestamp": 1658415621, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658415621, "uuid": "ffc84398-ee9b-4ec6-8c84-b4691d05f046", "comment": "Malware payload (Loki)", "value": "da60452b427233b3ab4397580184fefa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658415621, "uuid": "7e17af83-1a31-4433-9264-cd67338be548", "comment": "Malware payload (Loki)", "value": "3b88b119aeb3e3085b6f3d8aabf1d25840a50818e99e23ccbe838a89b2708ba6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658415621, "uuid": "9d12aac2-33f5-464c-86f0-28cf65e33305", "comment": "Malware payload (Loki)", "value": "b67b15d290aaa25608ca6e57ca449768b4463239", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658415621, "uuid": "f3b8fcdd-e820-4ed7-afdc-52dd12044452", "comment": "Malware payload (Loki)", "value": "8df7cf31659a1bb5019e20fc452775fcadbab4f06da8b30e9aba3134cd66c4e40eee2d38a5875642ba3a1a38df30aa2e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658415621, "uuid": "69269247-98f1-4c5e-a2dd-fcd8740f8042", "value": "T100F4123760E8A720CD7897B210936A842BF2B01F3072E55D68DE79DA85E57D1A700BE7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658415621, "uuid": "977e6f04-279e-489f-a699-565d283eb319", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658415621, "uuid": "8522c693-3d1d-44fb-8127-cd72627c0aae", "value": "12288:ausAUzzQUTy4ifl4/kb0BueF88jYcBflDunx8831h:ZOzCRCkb4ue+8Uc5x2xr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658415621, "uuid": "ec5efc33-589f-4bad-955e-3cd888a65bea", "value": 758272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658415621, "uuid": "44a1aba7-ea05-4415-965a-aeb629ea770e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658415621, "uuid": "bf028969-df64-47d4-ba04-37b9d8ba382f", "value": "SHIPPINGDOCUMENTSCOSCOSHIPPINGAQUARIUSFIXSCHE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0d2acce-08e8-11ed-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1658403154, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658403154, "uuid": "8d924a77-7255-4114-a52b-dcac383a2c11", "comment": "Malware payload (AgentTesla)", "value": "74514886e0d2d5bb29905a74d9bf1b59", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658403154, "uuid": "2c2803cb-8e7d-40e8-bcb2-f53325e65017", "comment": "Malware payload (AgentTesla)", "value": "3b9e3453f3cc1138a8b691a583ed2bad3655d97f8eaa54d48daff7f427784a7a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658403154, "uuid": "3fe02f80-74d9-49e9-88e4-b5a7bbd533d9", "comment": "Malware payload (AgentTesla)", "value": "41b9e64f015256b1f61f207f8ca4021629bda049", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658403154, "uuid": "443dc05b-a3e4-40ae-a303-011671a8126d", "comment": "Malware payload (AgentTesla)", "value": "bb09ca49fd91ece862417c7ac304825c04f7f46f068e30d1f7f23afcb114740faabaa54071acf1e80d548907e6ef72ed", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658403154, "uuid": "2335eef9-56f6-4436-9820-3fd28b5e4cba", "value": "T135D4E02737C2554CC16C7B77003A9AC0A3B1F9CB3A01CB5E698B53698E135DBBF0A995", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658403154, "uuid": "672c2a49-ca3f-4499-bfa4-5e4207fa506e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658403154, "uuid": "09c7e1d1-0131-42ab-a00f-1580b33187fa", "value": "12288:vISmmK2pyfNR0e88kv+vjqqFRHoJfRk+1kqWGZNfrfIo287e/OnCut35/:vISmmK2pyMeq+HFRcfBuqWG3LX0Onhp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658403154, "uuid": "fbeaf8c3-1a1a-4e33-8445-d4d4d36ab670", "value": 631296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658403154, "uuid": "57921893-915a-4e54-9c26-0650364bc3c4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658403154, "uuid": "a466029d-0d4b-411c-b2c3-8614b7de2c58", "value": "JJAB5BA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71a11beb-08e7-11ed-93bb-42010a9c0043", "comment": "Malware payload (GuLoader)", "timestamp": 1658402565, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658402565, "uuid": "41cc43e6-1bdc-449b-9634-712988534aa3", "comment": "Malware payload (GuLoader)", "value": "179cd8cdf98e272700e92f27290479ac", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658402565, "uuid": "24402f9e-375b-4c3c-880a-81dcf9a8f730", "comment": "Malware payload (GuLoader)", "value": "3bcbfe10ef765d420ae9aa6ce1c9b4337ef8de96c711b36a9da331ce9da4578c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658402565, "uuid": "89edc2cf-4ab8-4819-a667-e32ed581dd67", "comment": "Malware payload (GuLoader)", "value": "c033d885d633d7ac073012f504ae339e7486340a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658402565, "uuid": "bebfa6d4-7792-4c84-9fe8-53ed9ef1190d", "comment": "Malware payload (GuLoader)", "value": "18c2cc677cf4c3500c191a5732cde02028d2ac89ea064562731fec81bd2596f5b43c8bb404f442ce0282be3e52b73fca", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658402565, "uuid": "f0100f4b-a0c4-4101-ae3d-bc91cbd6ef3f", "value": "T1FD9412113BA0C9A3D8291BB10CFEEB3A4BF9DE0159695707BF84774CBE313956E19109", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658402565, "uuid": "8bdc2255-3495-4f4e-be86-154e12632671", "value": "5f0c714c36e6cc016b3a1f4bc86559e4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658402565, "uuid": "0689dfa0-55eb-4d57-9408-526964981d25", "value": "6144:ENW/WxaRsm+Nyt6h3KgvdoT/ltIXnsnQjjE4I/HIOrtOP7frc:MqKaSksh3KQKCCQgI0tOP7fr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658402565, "uuid": "e97d51f0-5ecf-488f-a007-d74a9e78a193", "value": 445432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658402565, "uuid": "ee8006d0-8f40-4c2d-a908-c60870c228c0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658402565, "uuid": "ad53d52b-8d7d-4703-a290-f3fa71b2fbb5", "value": "Richiesta di preventivo ordine nr 001 - AUDIO OHM S.r.l..exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2493e85f-0902-11ed-93bb-42010a9c0043", "comment": "Malware payload (Tofsee)", "timestamp": 1658414032, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658414032, "uuid": "c1847979-d1f6-4aa1-8c34-b77ad2784522", "comment": "Malware payload (Tofsee)", "value": "73dce3e7861a21a660c098f08fcd09fa", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658414032, "uuid": "519437ee-7164-4439-b8a5-eb2ac6a22c44", "comment": "Malware payload (Tofsee)", "value": "3c38e00f572800dfdcf676a141e4b98903977368f8870cd29221b3320b640ed4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658414032, "uuid": "eca1ea91-4a05-45f5-8a7a-7ccb3cfd2a36", "comment": "Malware payload (Tofsee)", "value": "2a555fece19e500f8c65e2b1e26fb6dbcd44981d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658414032, "uuid": "d0b36b5c-0654-490c-87ec-b76fe2d37377", "comment": "Malware payload (Tofsee)", "value": "4432731d75c7d06be7d6f55a8baec29907b11016ba17f37514a012cd076fa722e1c27b037feb67176bb99ec0ab587fe5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658414032, "uuid": "e6e3280d-29d2-43c7-a14c-cc4102a8145d", "value": "T142548E10BA50D435F1B722F8497A927CB62D7DA1972454CB22D52BEE9B386E0FC3131B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658414032, "uuid": "f3787112-af49-4acb-82ec-e7d2ab40b971", "value": "744be3b6710707387f7adba2a91fa8c4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658414032, "uuid": "7efc7a0c-e1e4-40b9-b7fc-208de292fc56", "value": "6144:K6ZiIPpBRMTMtRZe5g/4bE5UoB8VmniQR+L:P9rGTMDZe5tEuoVn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658414032, "uuid": "9e442857-3550-49a7-b0bc-481555ed89b9", "value": 299520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658414032, "uuid": "f024bbe6-de1a-4366-9188-c34c989cc76a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658414032, "uuid": "cb575bbf-3f66-4ccb-b91a-e4152a516a88", "value": "73dce3e7861a21a660c098f08fcd09fa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10530d58-0928-11ed-93bb-42010a9c0043", "comment": "Malware payload (Socelars)", "timestamp": 1658430319, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658430319, "uuid": "af5609b2-4bce-403f-8829-bfc6d824d157", "comment": "Malware payload (Socelars)", "value": "4679f3ea1c0566c5b3814b78a92cae12", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658430319, "uuid": "84fe5fe3-42e6-4c31-96c8-2061be76ca78", "comment": "Malware payload (Socelars)", "value": "3c742d1d50c9b8f91845b96c5f447cdfd6bcd4f10a10008a883da55e7e63c721", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658430319, "uuid": "43ada5e8-10f5-4af5-b87a-86550cacd3a9", "comment": "Malware payload (Socelars)", "value": "08da3827d4a0518eeaa2be4f8406a492772753d4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658430319, "uuid": "4d335db3-323e-46e9-b215-621dff832acb", "comment": "Malware payload (Socelars)", "value": "a8e479e668cab918b256cf0273b56f5a1d3324b01cad840b0fad3e79159533102414de69ad9892213832700ff8cff3c7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658430319, "uuid": "43f56eb5-717b-4083-9a73-9bd17c47b1c7", "value": "T18E659F11F642A036EDE3007282FF5AFECD28BA21031454D7D3C45D6A6E619F27A37A5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658430319, "uuid": "7851b832-a365-47c5-87e8-319d36b0a291", "value": "d69e4c13e25f0ad622344ac56118c0df", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658430319, "uuid": "799faf6a-beb9-4f64-8fef-a528877320a2", "value": "24576:gsLp0FasdJu/+/dfMs2KLoyaU/5DejgtMyPtTEN+o/iMd:FpncZO+bCyPtTEooqMd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658430319, "uuid": "19ad3afa-46fb-4237-a220-e4a0a15da2f1", "value": 1494016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658430319, "uuid": "e9a7297c-fb75-4cf8-8faf-4bb52a6219d1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658430319, "uuid": "560e4462-a9df-46bb-845e-4377f2f8dc77", "value": "4679f3ea1c0566c5b3814b78a92cae12.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38779218-08cb-11ed-93bb-42010a9c0043", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1658390443, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658390443, "uuid": "1a2f632b-3705-4b33-82da-5632a52acdc1", "comment": "Malware payload (AveMariaRAT)", "value": "473a6dfcfcae49b069cb8c65da1dee3a", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658390443, "uuid": "4570ebf8-1868-44e9-950d-d10ec0663b03", "comment": "Malware payload (AveMariaRAT)", "value": "3d74100e5ffc75487ee90b9fb944a0fb5371c1b5b385580c8ce4caee763c09ce", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658390443, "uuid": "8dcb4364-6276-478c-9df1-aecf3d091975", "comment": "Malware payload (AveMariaRAT)", "value": "6bd4b04ae30c410f57d12a04c47555ad33f43566", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658390443, "uuid": "4c6f5893-c165-4719-bf4c-2ea556bebc4e", "comment": "Malware payload (AveMariaRAT)", "value": "b9d2156f84f6a8ea11f83193ae740fda1eb205357805b730978d0edea26e76fe43357d0ae2b7571f4a33bc66695e504a", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658390443, "uuid": "a8ac79fd-62cc-4bf7-a0b5-be1ddccbec85", "value": "T1A034EDA0685F49B2E608DD1E25A4F6506EBAFEFB30C1147123AFE470CF55AF29EC8550", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658390443, "uuid": "41dffacc-ee96-4faf-8669-4d1d24cd6445", "value": "1536:izvYOlom3JH0qMPSlYdoPpWcBXtAhvZVzFz76mAg5eeVhMDw5wfLc:i/h1wVzFtr5RDAw5wfY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658390443, "uuid": "e6d070cc-5ec1-44a1-86a6-fcc339803795", "value": 240298, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658390443, "uuid": "60d5b00b-0136-4372-b298-2746b86cf677", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658390443, "uuid": "b628a1c2-834e-40d9-a2ef-b835d67c611a", "value": "Contract.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b86feaf0-08e0-11ed-93bb-42010a9c0043", "comment": "Malware payload (GuLoader)", "timestamp": 1658399677, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658399677, "uuid": "1b11dcf1-f653-4370-a322-ce9646320d89", "comment": "Malware payload (GuLoader)", "value": "eb2542354569a66283b1e6aed028851e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658399677, "uuid": "199a0b98-ecde-4e37-9e6d-b2bc863ebf4a", "comment": "Malware payload (GuLoader)", "value": "3d7428999a3bc90f003d9ea3673abc88c6d9988fc875d45c088dfe8f61fd3e0f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658399677, "uuid": "93f55097-2b83-4a24-9d7a-b85f35d37afd", "comment": "Malware payload (GuLoader)", "value": "4fea89de3c93d412eaa08997c5c1469b01aa8685", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658399677, "uuid": "1f5b4aa3-3970-4f74-935a-bcd6194a041b", "comment": "Malware payload (GuLoader)", "value": "67a78011b6e667781946fc46a551eb52c274702ad22da0ad404414458f418ccb27cb1ca2011bf5df687e2ab7caacb4df", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658399677, "uuid": "67e0af0e-50f8-4487-be70-699b034f3a4b", "value": "T184D301B213A0D493C7F742B119797217EFFD92A124E8960BB374BA84BC757C25A1F122", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658399677, "uuid": "5308b701-76f4-4500-86c4-af274b445043", "value": "f10e4da994053bf80c20cee985b32e29", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658399677, "uuid": "4459102e-0309-4070-ae60-69d1303b08a1", "value": "3072:9Fi6z/VXzAf3oc6ubtjfslWvifbJRHo1VlIjqm1JC148L1qF1ZF1:9xFSNxfsZI1VWmm1JC5BqbP1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658399677, "uuid": "e91ec449-e911-452a-88ea-3c00cfc8c05a", "value": 131600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658399677, "uuid": "80b9a69f-96e8-4abd-85dd-ee4fd4301435", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658399677, "uuid": "34b8bd6c-d84c-4283-96cf-bfe7501ce16a", "value": "TT_ proof pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17fb08bb-08c4-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1658387382, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658387382, "uuid": "c5a4c936-f68b-4e65-96d7-ad01b01ab407", "comment": "Malware payload", "value": "73f528fb33a48dd2b3b83c24d9beb024", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658387382, "uuid": "57c66a95-fd08-4c09-b37b-8c892a3b4076", "comment": "Malware payload", "value": "3dfddea399e2c47eac15cea44728aaccba5f2a720bdf10de75092e68c8df1c82", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658387382, "uuid": "9737c632-42a8-42c0-a0f0-1bfdc8d64898", "comment": "Malware payload", "value": "5ba157f7205d16fb67f517328991a521f0918555", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658387382, "uuid": "1919f717-d9e2-45fb-9d2c-b3b14cff9ab0", "comment": "Malware payload", "value": "90ff5df7a2bf7154ea2c382d72d9a628893ccb2ffce826da59f415c452b4546f70939c16ad0ccfac58643a27adad6ccd", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658387382, "uuid": "4391cc0d-4697-4855-b016-1c9a2949a385", "value": "T1D60633D6C2FDB52DE2DB2EB22DBD8B45F55D4B04C082D0768E268DDE2BAA3423351153", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658387382, "uuid": "4565bb9f-ca6d-4eaf-85ab-0c23d1fc80b8", "value": "49152:8Eoo9aGudszJ9oKtAjE6f5Waf7Zyhx4gnYnWZ4ps/WhULR/7g0jsYApl0dZaHuja:pb9Tu2lkHq4gYnSAs/j/Lju6Hwr7f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658387382, "uuid": "d3d2e2c8-1677-45bc-a4bf-3c2422b8dc40", "value": 3766805, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658387382, "uuid": "649c9496-6dfa-40d4-8620-0127418f9e68", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658387382, "uuid": "7ebec1f4-45b7-470a-8e7e-076f5c1e7481", "value": "19_Comprobants_Pagos_BsxApJiJMLeDMxS15.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a303da61-08be-11ed-93bb-42010a9c0043", "comment": "Malware payload (RedLineStealer)", "timestamp": 1658385039, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658385039, "uuid": "5b9e8f68-02a4-4232-b071-9d79947bfdf1", "comment": "Malware payload (RedLineStealer)", "value": "f762c459e298cd903870f75853ebd71d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658385039, "uuid": "ce74f464-a0b6-4843-99fe-4ee22ffc3816", "comment": "Malware payload (RedLineStealer)", "value": "3e30ecb6c9931bfca6bbf7014fff76277b9b537c02c48b52f9f7889b954214cd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658385039, "uuid": "bee8374a-4c21-496c-aa13-e4c3a7210b8d", "comment": "Malware payload (RedLineStealer)", "value": "f4796deddd23536e39cff4066af5feb632075d7e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658385039, "uuid": "8938eb74-395c-406c-8848-691e40f7d4ae", "comment": "Malware payload (RedLineStealer)", "value": "7ca401723fafacb754ab861ff3f79a60ae418dfac6b70ea5d9e6bb1ea2f46be63150f0ffa08d79a691c0529d799483c8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658385039, "uuid": "e70d311d-575e-4e5c-bb6c-67754edaa923", "value": "T19E84129CA389994BC68A54700AF799B4E2B5EDC4D481340323C2BB2F793159CD98F367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658385039, "uuid": "7d3e3b9c-84de-49dc-9eff-06f7374a8cda", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658385039, "uuid": "7a7849e6-f290-4b29-9b4b-9a1eff459aaa", "value": "6144:Cw/FPnSpBx0oKJ0HXO+/gI3Kjggj+XaxvPYJINsR7vLYLz37:RltFJ0Hx/gGgj+XsvPWq87cLz3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658385039, "uuid": "bda34e19-5dff-4081-a6b9-a619889e30b7", "value": 398336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658385039, "uuid": "704ea6f0-dd98-4de4-848f-1113fdda6a44", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658385039, "uuid": "f492cabc-2b8b-44a2-808e-aa9eb93b1d11", "value": "f762c459e298cd903870f75853ebd71d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ddfb5a01-08b6-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1658381701, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658381701, "uuid": "655ab140-4bb1-4d9d-a5ee-177430fed77e", "comment": "Malware payload", "value": "ff3e19fba4f0ccf4dca945089eb2161a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658381701, "uuid": "e2c85f21-7977-4781-a7f1-9b5fda06d700", "comment": "Malware payload", "value": "3f0af3ef0c63afaa634744ff0ac77b2510d5362544b85832aa20763deca94509", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658381701, "uuid": "e43514d6-8ab9-4f55-b8ce-e47ccdb68dd5", "comment": "Malware payload", "value": "1d855f619ffb7799001a37bc1f448380381b78dc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658381701, "uuid": "bca799ca-fb8f-4292-b268-08140ac3957a", "comment": "Malware payload", "value": "da52adbde8340df69fa8f54785ecac0ee07dd1d3746cccbb7ad2466de18d806e140b4954fb044020f32ee2ca48c9a199", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658381701, "uuid": "45d8387d-dac9-4bf3-8873-6e3737192fb3", "value": "T16F043CD3F5C0A3B2F8BCC932F65BA1208A776FA36A42452A14D0B79215B3441FE7AD15", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658381701, "uuid": "3cfe2ae7-5351-4fe6-9a67-59d4173176e5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658381701, "uuid": "bbf9d741-1560-48ff-889e-c19d768d8883", "value": "3072:yZlwdx8hRIH7eznNELfQbSRlWqDqfv2a:0wdihRIHS4QbSfDqf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658381701, "uuid": "168ef74b-3252-4d20-b028-c29f03e3a5cd", "value": 178176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658381701, "uuid": "a998c212-6aa7-4ba7-9d82-e93f9f2b5cf6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658381701, "uuid": "8444d62d-ff9e-4ccc-b72f-e4c2ee0632ca", "value": "SecuriteInfo.com.W32.AIDetectNet.01.29956.11783", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7665bfb-0927-11ed-93bb-42010a9c0043", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1658430170, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658430170, "uuid": "8f8e980a-0962-4cb3-8b5a-f9a6160e59f3", "comment": "Malware payload (SnakeKeylogger)", "value": "3573ed7d109b993e10acb534c8689dfe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658430170, "uuid": "cf18a6a2-6a83-4124-a599-7dc91d5ceaa9", "comment": "Malware payload (SnakeKeylogger)", "value": "3fcf72308860c2bbd42897710e0cfa84486637c8b5694981880e23e64d423716", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658430170, "uuid": "f23d08d6-3e93-479a-90d3-ce388b8d66a7", "comment": "Malware payload (SnakeKeylogger)", "value": "89a0430b9ff336e0f2c1ccfa4078a9f65424467b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658430170, "uuid": "d29b6b8a-302b-42d9-8ea8-d05e1e9d282b", "comment": "Malware payload (SnakeKeylogger)", "value": "324b02c5439d00ef7306adf0866448d8d9693c5f4a41fadc81b9c7bba95b92c1013ec2ec57ac13d194bc4839a65982d3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658430170, "uuid": "9973c448-f762-4d60-ada4-5cf05d75d81a", "value": "T1D4C4023332F7FA11C93847B240F362484AF2624E71B2E55B34EE655989E63DA5B813D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658430170, "uuid": "6dc3498f-1a00-4666-83c5-44d0ba978d5c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658430170, "uuid": "6b4b2e6f-75c2-4ff8-8447-9078c219a9bc", "value": "12288:zJZBgg31hnx81QSyPqO6EXpXOvZMVHf+5O6S4Qwe1+o:3nnxEyPm8+vyVHW5O6bu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658430170, "uuid": "e8972660-a58d-491e-81ac-3877d7268f24", "value": 562688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658430170, "uuid": "1dec98fb-b5f2-48ff-b509-7222acca39ad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658430170, "uuid": "b33fa884-94e1-4d74-8ff5-8b3290592dde", "value": "NEWAY RFQ.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2cfb2ff4-0932-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1658434662, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658434662, "uuid": "b6d87f5b-b96d-4025-a367-6d4ede9790a9", "comment": "Malware payload", "value": "a384b001cbed6eecad312a5865609ea3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658434662, "uuid": "d8a0275d-1913-4c17-8b6d-1d5cf303080c", "comment": "Malware payload", "value": "3ffc1015df7b7c4cfd39da7d1a886fffeb29c8c00e0d121db3c9038d7833424b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658434662, "uuid": "a0752f3e-a9f3-4bce-a0eb-98bb806beb39", "comment": "Malware payload", "value": "abf3fb02f671c19cd6a8a050ae8d64f20b6f9137", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658434662, "uuid": "1814984b-7fed-4f48-8120-65b6fc8ea254", "comment": "Malware payload", "value": "434b05c82448682626bd46ca07a9c860dfdab25f7244d8faf7b42f29fe9bf677a41d688c4b441c6d5719239e62565079", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658434662, "uuid": "ed6e2fa3-7dca-46d4-b881-cc3747f11010", "value": "T127D3C717BB618EB3D85FCE33059A4901248DE19B12D96F6BB2B4C96CE74B84F08E3D54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658434662, "uuid": "1fed7e02-dfa6-4bcf-839d-ef69fb83042a", "value": "1536:Jfj3eTqhhm1NFkM9CZH6ZFsvHsUCxoULeiWWWrttDbUmkgjFxq/bATF8:JfjFOkfBHlCxgttDbUmkgjFxqDATF8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658434662, "uuid": "69f8a3e1-9388-40ef-acc7-fe73007836d1", "value": 132975, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658434662, "uuid": "2aab0f22-f2db-4146-af34-54205ca71670", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658434662, "uuid": "7b0fe2cd-63a1-40be-92e3-37a530581176", "value": "a384b001cbed6eecad312a5865609ea3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08a2828c-08ab-11ed-93bb-42010a9c0043", "comment": "Malware payload (Vjw0rm)", "timestamp": 1658376619, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658376619, "uuid": "1c69f8d0-8476-4b85-84fc-fd21b83345b8", "comment": "Malware payload (Vjw0rm)", "value": "0db97bad270d6eccfcd9ee9720a276e7", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658376619, "uuid": "b3a517ad-f7f3-4124-9bdc-ff2ddf59f89b", "comment": "Malware payload (Vjw0rm)", "value": "40515db3f3ce8f2c90ff788b5853582a8de3bb13c775ec719936cfeba9b7ccfa", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658376619, "uuid": "0f1c7d7d-1934-4b0b-b26f-d862501a7b72", "comment": "Malware payload (Vjw0rm)", "value": "f2979599bea653561379e9de4a51745c3d3a67d6", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658376619, "uuid": "349ccc70-f579-4f52-be85-6ca3cf93aa39", "comment": "Malware payload (Vjw0rm)", "value": "f02d42c24d08ddcee0808f2de85600b3cbf1881c7da6aa0b6ed2a4c8bb8d4e900b07d8b420b98d4829e85444ff29957e", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658376619, "uuid": "75704f89-8945-473e-ab0c-12ef9310a711", "value": "T1CAF14BC2AC2D7E298B486287476DCC183FBDB99B45606F5E3860B488D130048BDAE36D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658376619, "uuid": "75026af0-2bea-4030-99f7-c30f3828e7f3", "value": "192:OZdF/M/bN1J0FHyP1GZIoSJ5SvNdYY5UK4s0QoJo:O3gPIyJ5SvI2UrPo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658376619, "uuid": "ee20ca5b-fd96-4da2-b676-cb85bb5e5c33", "value": 8008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658376619, "uuid": "e4ce96a6-5231-48e9-afd4-aa45335ec666", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658376619, "uuid": "f59b84e2-8f14-4117-ba2b-7135e1bc97f5", "value": "IRGhydCzALpicS.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ab234f5-0930-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1658433799, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658433799, "uuid": "a614efd0-a116-48ac-960d-945e0d11bc03", "comment": "Malware payload", "value": "ec38a50c4095fd15c755920134fcbeb0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658433799, "uuid": "a8d490e1-9ed0-4ab0-84df-7660d6603b59", "comment": "Malware payload", "value": "41555b01c47005a89c1dfcf871c12f4277e651f233bc4f3da0d22442595c2a38", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658433799, "uuid": "1c29b10a-4a0b-4ff4-91f8-81326ff0ae82", "comment": "Malware payload", "value": "53f4df8346834d195e65f862d9c2d203677c7183", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658433799, "uuid": "72f71533-3c10-4005-821b-90db36e38bf5", "comment": "Malware payload", "value": "9662294e06e0781a1d1e8ce86356b1cc45bcacf43a35abc71f645bb854aa0451bd9697f1ebfd1e3e342addd6a4ac9848", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658433799, "uuid": "d2b64382-3fa8-49f9-89a8-863e227cb102", "value": "T14D551964A3E51115E9D7AB7F72A08B90C8AE3C415D6DA7CF0D460AC6CA3D2F479086F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658433799, "uuid": "f2883cc5-9608-4463-8c59-7224e096d5b7", "value": "fbb4b79a85ec5d8a98f3404901c2d073", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658433799, "uuid": "fd62d0e1-38e9-4277-b254-70a948b2fe47", "value": "6144:2+w2jR+A6rnCw4VXQNkCkNfY0tmS3Qg4wE/1Y6fqNIDhlUu+4RYkKWJZjaRiZru/:DnjT6rnAVAyC70wyeMWZX7LfLoz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658433799, "uuid": "d941b450-d57a-46ad-8650-e938ddee073c", "value": 1402368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658433799, "uuid": "7c41908a-c0f7-4c28-b708-2687be4c8a57", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658433799, "uuid": "29e66a11-2e1c-4601-8d77-d6aa20f37309", "value": "ec38a50c4095fd15c755920134fcbeb0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "853fba4f-08c8-11ed-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1658389284, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658389284, "uuid": "d51b0011-53a4-4fbe-8fa2-4e50facc8193", "comment": "Malware payload (AgentTesla)", "value": "ecf75c632b1d273ca13687cba8e081aa", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658389284, "uuid": "a59db150-ccb6-4add-b034-98ea2ad60018", "comment": "Malware payload (AgentTesla)", "value": "41fa02ae9f175121c3efe411ce3554d78a2e04bec3bad9d8bb04326a71cf6825", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658389284, "uuid": "6e17994b-6627-4fc5-bc7a-cacf8fbf357e", "comment": "Malware payload (AgentTesla)", "value": "905211b5715d63a782901e8fc2adf6f36d30d782", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658389284, "uuid": "e6d9c74c-bb70-4969-9043-416e76be6e5f", "comment": "Malware payload (AgentTesla)", "value": "65ced7119c462567440ef15c1a62efe3c9abc06bf1088e407a4872cad858b62e6e98466d3e46f902320e872875c264a1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658389284, "uuid": "dec49ee6-3263-436a-9d89-7c8ad1e1962d", "value": "T19C05123771E4EB22DA3883F11163664D2BB2B10D7134E62E289EF8E985F5BC456503E7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658389284, "uuid": "6935a105-3c8e-481c-b2dc-39c224f8c04b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658389284, "uuid": "2aadefd2-e9e8-47d4-a5ad-2c8fc798f3d7", "value": "12288:NsKx8Dl0MSOBzMVsZkXuVqXRuIXX6eRbOG3/ADnkZHpM+31h:Bxp2Z4sZkYWn6edOiYDn7a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658389284, "uuid": "add945f8-789f-4144-9bad-049c993df355", "value": 856064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658389284, "uuid": "fc679aa4-763b-4248-b7ad-f6812b5d6919", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658389284, "uuid": "13fd6583-2425-42fb-8b00-dc03355a91d5", "value": "New Order 3067729.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8c91dc4-08c0-11ed-93bb-42010a9c0043", "comment": "Malware payload (RedLineStealer)", "timestamp": 1658385961, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658385961, "uuid": "70b84430-9e26-4f24-999f-d481c463af1e", "comment": "Malware payload (RedLineStealer)", "value": "34010352c4183ffb517a498cb09ec6cf", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658385961, "uuid": "81e85690-ec67-4d2e-a03a-cd13a717314c", "comment": "Malware payload (RedLineStealer)", "value": "4304a97cd12758523bb048cf4ce709c00ac5fc7c94a8c9de422e89764644ac81", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658385961, "uuid": "a33bc516-f077-49d3-8275-956f368e6abf", "comment": "Malware payload (RedLineStealer)", "value": "81145e4839db505a0b633ec8de3a9d8aa3833ab0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658385961, "uuid": "fee219b2-f24c-4472-a885-d77790b07806", "comment": "Malware payload (RedLineStealer)", "value": "836af63ef416debe6350c41ce5bacef51dfa2f61c7b12f2daa8502547d774a038b7036ca9b5d0e944e0ba9a507a6cc26", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658385961, "uuid": "c79baaad-d281-4197-b34e-bcaebcb3bcf7", "value": "T1DD65F8B60BCF8C13CF0E78BC99F5959961635DD3168B62C0A1B1FA75D7BCA212887087", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658385961, "uuid": "421b6224-f5eb-4100-803a-9710ce1e3adb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658385961, "uuid": "4ecfb1c3-0813-44c4-834d-a9307ddd18aa", "value": "12288:j6pvxbrkAxxdrwRcZGTGlK1toSmrSUlP3i9YWFyZ:eDboOdrwRcZvECSmuUlP3qty", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658385961, "uuid": "77587791-1f47-463a-a9c7-a6bf8276b993", "value": 1419776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658385961, "uuid": "0082039c-3ef5-4920-95c0-efcc6a627d75", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658385961, "uuid": "5185f4e8-daa8-4498-8d4b-a53776a6d80c", "value": "34010352c4183ffb517a498cb09ec6cf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2abe7a46-08f3-11ed-93bb-42010a9c0043", "comment": "Malware payload (AgentSmith)", "timestamp": 1658407600, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658407600, "uuid": "bdd79b5e-e269-485e-9d5f-dc1068456eb5", "comment": "Malware payload (AgentSmith)", "value": "87118a9b63adebe8ad642509ff76818b", "object_relation": "md5", "Tag": [ { "name": "AgentSmith", "colour": "#267200", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658407600, "uuid": "b11bf68f-cab9-4662-89c1-57ddebf56012", "comment": "Malware payload (AgentSmith)", "value": "4304e04f719ee4092d91d6c50040dbd4fa3bce021c651f141fa006e99aaa123c", "object_relation": "sha256", "Tag": [ { "name": "AgentSmith", "colour": "#267200", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658407600, "uuid": "e6458d06-94b0-42f6-a206-1e1d48ea2026", "comment": "Malware payload (AgentSmith)", "value": "da699640a0670efd1c027658ed1756687c029ff4", "object_relation": "sha1", "Tag": [ { "name": "AgentSmith", "colour": "#267200", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658407600, "uuid": "292d766b-1551-4fe0-a334-2875c971f0fc", "comment": "Malware payload (AgentSmith)", "value": "0978bffa27618f0426a1b222aa4a749b1d0aef2605a49983618d5d729ad00713553069ba141360283cf8f46c354cfc30", "object_relation": "sha3-384", "Tag": [ { "name": "AgentSmith", "colour": "#267200", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658407600, "uuid": "7a8fbceb-66d5-40c5-a1dc-21a38c4327b0", "value": "T17B96F103FA45A952C3E64131ED7E823573123E6CD3F7A137BA08B2E439B76C63A55684", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658407600, "uuid": "996a16e7-c69d-43e3-aad8-48afe50e3196", "value": "98304:dvnNsxJkwhg9uvc+VoWhDn72lv4XNnGOaKtzSLaDBS4T2LdO4pUuELQfufdynV22:F9Qg9Q7VoWF7ddOKtXty2hcfuYVue", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658407600, "uuid": "533a541c-0eed-4df0-b336-1379d436862e", "value": 9154152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658407600, "uuid": "95b11b63-059b-4e62-9b7d-6eb699c511d0", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658407600, "uuid": "f729aa45-2188-4644-b8ab-63e5656038ac", "value": "abhdhfjdcjo.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17f4e8fd-08c9-11ed-93bb-42010a9c0043", "comment": "Malware payload (Stop)", "timestamp": 1658389530, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658389530, "uuid": "5a22c25f-a421-4c38-aa73-0c1a3c4b0144", "comment": "Malware payload (Stop)", "value": "c0adb7f0e7fcadf5f735ac053b381fd4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658389530, "uuid": "64912d45-7540-472f-876a-50239c0de014", "comment": "Malware payload (Stop)", "value": "43f082c553a81185c0dc6517965f44c8466d16ca5ea471a0235a898dda8704c4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658389530, "uuid": "8d051b71-b7d3-46fd-8e92-8e748df1dd33", "comment": "Malware payload (Stop)", "value": "6a26e603d08093fe0e3c2f481d89d703406a45fa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658389530, "uuid": "06a3959c-be17-4346-89d4-5370f9d0c8af", "comment": "Malware payload (Stop)", "value": "ded71151b1faa97ecb7b43a4f760dca45736b5259eb7c63f621cc40f3db7450425690b5bcc54b5a6b38e1f1cc412e995", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658389530, "uuid": "5e0cbdb0-2d5c-4c59-9ab6-a95b5d98953d", "value": "T111050210BAA0C030E5FB12F4957992BDB92D7AB15B3050CF62D52AEA5B346D4FD3231B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658389530, "uuid": "d87d5093-7bb1-455c-880d-625cc62ec847", "value": "eab7d550b9cdca5c6bd9023d54b79da8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658389530, "uuid": "27305b13-3e85-4f5c-9ee4-406fa0fc8598", "value": "12288:arNZMrVbX3ANDV2/UKM5hGjcHmi6mlgIkHdy/dafcvOGxcJqDU4o230TnCIOULAU:XHAa/ZM5hegjmy/IfRYcknE1ozH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658389530, "uuid": "f4af8950-0081-4dbf-8f9f-4f8e233bc4e9", "value": 816640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658389530, "uuid": "d62e15f8-1b1c-461f-9dda-ea4735d08539", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658389530, "uuid": "92fc52f5-1e70-4ecc-aaef-219febc856dd", "value": "c0adb7f0e7fcadf5f735ac053b381fd4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "356908bd-08e8-11ed-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1658402893, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658402893, "uuid": "411f1f74-a088-4bf1-850d-9aa9dd48e84b", "comment": "Malware payload (AgentTesla)", "value": "9616ca400b972668c6642ebf632b3fa3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658402893, "uuid": "6cba58fc-a142-4be7-8ec5-4279e8568ec6", "comment": "Malware payload (AgentTesla)", "value": "44ac93233199a7bc7e6f17be959844e6448f4e612f7f71909f2dfd41c3b388a7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658402893, "uuid": "d9f32522-e549-423e-a8a9-2412032b5de9", "comment": "Malware payload (AgentTesla)", "value": "88530fc14e1f7cb7600258dff9e9980f9e952df3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658402893, "uuid": "1d9157ae-db3d-4e0d-bb59-ef21058494a8", "comment": "Malware payload (AgentTesla)", "value": "4d12e2738b1641cd1053c1f49c57454f65992d7ed16cb747b9abec274d6fdf68c79a44f309cf7e31ef023e4e8ec12f05", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658402893, "uuid": "197e7fa7-1b79-4ce8-999d-3b4663f1bcd4", "value": "T185C4D084F6C5C16DE4FBC77D0BF4947477F9FA228505E47A2EA01D8E4A52FC88A42932", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658402893, "uuid": "fb69baec-1343-40d2-a984-66b22c4486d5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658402893, "uuid": "fee1ca3e-251c-4d35-8374-ea1635faf505", "value": "12288:/YYP0u0T2iNcx8q1LqGl84xHubGdoIGCjcjcp78x3aC7CQo4:A+WT1Sxf1Ldl8UuX0cjTc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658402893, "uuid": "08edecd7-f5bf-438f-9a09-925cdbd2915e", "value": 591360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658402893, "uuid": "e5e63535-4142-479a-90f3-eecb2b975a86", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658402893, "uuid": "16a3fdd6-fc79-4633-af01-7ce6ae34e582", "value": "FOLLOW UP PAYMENT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "464fa5a3-0928-11ed-93bb-42010a9c0043", "comment": "Malware payload (SilentBuilder)", "timestamp": 1658430410, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658430410, "uuid": "8d572c7a-7154-4894-acbb-42fbae5e5cc5", "comment": "Malware payload (SilentBuilder)", "value": "3fa7db5121b4b0f8e020806961bad487", "object_relation": "md5", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658430410, "uuid": "94e50e3b-2a73-4a93-b0f6-71bf212f239f", "comment": "Malware payload (SilentBuilder)", "value": "4573b7847737da27a2ebf902620d7d538e8901cbfbfb165a49a18eb326532bc5", "object_relation": "sha256", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658430410, "uuid": "b167113f-c87d-4201-a4a9-679e6020b4da", "comment": "Malware payload (SilentBuilder)", "value": "37dd0e4cbff0ba89fbed6355805aaf60e655979d", "object_relation": "sha1", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658430410, "uuid": "2f7a1f80-0dc2-4ab2-897e-e71bfe5e1911", "comment": "Malware payload (SilentBuilder)", "value": "1eb427dbaa201996bdc252dea5f5a317adc8a91b4825efa7c7a51d220304202ffdedb7771999023305f269a0c08cda33", "object_relation": "sha3-384", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658430410, "uuid": "1bbc6d51-563e-4cbd-8566-69b2e44627af", "value": "T1CDC251A7BA86D8C9DA8513394C734658B767FC165FA743073659F3290FB0AE08D0361B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658430410, "uuid": "5379cd5f-f99f-40f8-8a62-3995cbee1c2e", "value": "768:bsk3hbdlylKsgqopeJBWhZFGkE+cL2NdAJMrSn:bsk3hbdlylKsgqopeJBWhZFGkE+cL2Na", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658430410, "uuid": "d7b3db54-6c0d-4812-99b2-67dbb140e9ba", "value": 26624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658430410, "uuid": "0e07ce13-f7cf-44d7-adb1-1fd974673b7a", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658430410, "uuid": "700cc86b-ff0a-447b-bb9b-0abbe44b94a6", "value": "Swift Transfer.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cfcf6b9f-0927-11ed-93bb-42010a9c0043", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1658430211, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658430211, "uuid": "046831c8-f006-4e71-a9f0-174267788993", "comment": "Malware payload (SnakeKeylogger)", "value": "ee690a2b08fe9e5d4de82f71ba4aeb56", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658430211, "uuid": "44f0726b-bf00-47d2-8593-7bfbd31784b6", "comment": "Malware payload (SnakeKeylogger)", "value": "45e22bd715f8c36701e6a14fe4f35153364cc6ae61ba6f2081b2a59d8b0ef04f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658430211, "uuid": "f80ca909-fd31-4081-b3b5-78ff532494ce", "comment": "Malware payload (SnakeKeylogger)", "value": "6cb657c2b46c7dbd8ef36a0f9a4e5c2a6e8aee6a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658430211, "uuid": "02551a91-4444-4846-85d6-a38415055414", "comment": "Malware payload (SnakeKeylogger)", "value": "2255914b56ae54d0f3e22551c768c0eb9167557258ce0ff50d45d2a34c1efb2534042f611496e7121d882eccd9c88c85", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658430211, "uuid": "de9fb5ab-8a5a-4b21-9e05-dda6c1a2cce3", "value": "T12DF41273A1F5BB10CA3487F110B362890EF2210E35B1F65E2C9FA5EA85E57D896413E7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658430211, "uuid": "64b74493-c558-43b7-abc6-0580c3ff5327", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658430211, "uuid": "80bacfe9-3349-4198-bc89-13e0bb5fb629", "value": "12288:csDn+oAbbs262CsUuaH3XdcrS5WaqSmXKrRzzJi7a4CPr/uHXgJCMdx8831h:T+oJ25PdMXdTW7SmXGR/JiyiHwPxr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658430211, "uuid": "ddfe29f5-47cc-42a4-8014-89f11752f479", "value": 794624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658430211, "uuid": "2c301d91-520b-4f5f-86fd-feb5a114f3a9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658430211, "uuid": "06e1c098-dd47-4f41-9a6b-0b5750550344", "value": "revised pi.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6181e392-08b9-11ed-93bb-42010a9c0043", "comment": "Malware payload (RedLineStealer)", "timestamp": 1658382781, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658382781, "uuid": "9eba3ec3-6779-4408-aad8-e831d1d4e65a", "comment": "Malware payload (RedLineStealer)", "value": "c12407e485266274334123e382ceba64", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658382781, "uuid": "5a34736c-a387-409a-bd36-e75082bb4775", "comment": "Malware payload (RedLineStealer)", "value": "46edb10921661af6ec169b69267bb559318ec2e3e82e4c066308baad540f499c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658382781, "uuid": "910abe00-1b19-4f99-9927-29071f8675b8", "comment": "Malware payload (RedLineStealer)", "value": "94f9a3c6e4d5ca01132ed79e25121ed124fbd41e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658382781, "uuid": "9d9ee3a5-146a-4f12-a76c-3abcf67483a6", "comment": "Malware payload (RedLineStealer)", "value": "4151d3a255dacf12ad0f29911af7cd3f9355cee42e046a694c55eab844b7fa64213c93225773becbaaf30d192c94d166", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658382781, "uuid": "b806ca99-cec5-40f4-bfc7-ac4a1e1f4072", "value": "T1C1E45BA67293D169D0C04C7AE60A76F9E9D33E79DCE396C335B0BF3A317A121851E112", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658382781, "uuid": "cd8ea8ec-d035-44b7-bbf1-b1fe966c7ab6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658382781, "uuid": "4e10dfd4-a3d8-40ff-99c5-801e9e51a7e6", "value": "6144:RgRUnVqG0/KV2S4mDPB9jv2xYK3qW6cJexfl+8wsfmiqVR:JVgE2rml8l6W6cMyrsOv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658382781, "uuid": "26650ee8-60a5-419e-b44b-fcdbe0fc7f83", "value": 697344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658382781, "uuid": "f60f1259-965a-4869-a186-7aeee6c20cc2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658382781, "uuid": "0c390349-3714-474a-a1bd-5b08bc0d0de5", "value": "c12407e485266274334123e382ceba64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60076c68-08e4-11ed-93bb-42010a9c0043", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1658401247, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658401247, "uuid": "c3f95a5a-d26e-4b62-9622-a4480692737a", "comment": "Malware payload (SnakeKeylogger)", "value": "12481777b152123a28faca79578905f0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658401247, "uuid": "0cb1c852-0723-42f7-957c-e60e0dc182e7", "comment": "Malware payload (SnakeKeylogger)", "value": "480e6eafca7220040b5c881ba63412843e888fb54e21b158a2568bec0cce0acf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658401247, "uuid": "0298abba-f790-4584-86e3-86c7c4aa4f49", "comment": "Malware payload (SnakeKeylogger)", "value": "309d7bb76c5455d773329dc30e45248cf15f2b46", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658401247, "uuid": "e4c9efb8-522d-4f13-b8e7-8eaa7a4e83bd", "comment": "Malware payload (SnakeKeylogger)", "value": "c847a69f6df420e749652ffb07ed33ea287ce2ad79aef6743bb7906f8a8e73616a38642a6c57b03a8df6ed6cf8ed1b1b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658401247, "uuid": "8acff406-11cb-4596-a50e-4cd8a180cf04", "value": "T176C4013375EBF911C53887B281D352480AF2B20A7172E51F39CE65568AD23DE9B807D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658401247, "uuid": "ff6fa6a2-5af3-404f-a9aa-05a5ccdebf5e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658401247, "uuid": "dc8e8467-842e-4426-ac9e-8ab8b5e5d4c7", "value": "12288:ll8gg31hUx8ddltkTpjHQ4j5vNs0TAgjMkKxUY:SUxyuTpjvj5mg3K6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658401247, "uuid": "99fcdbac-3cbd-4c9b-a16e-7a36c35f9b41", "value": 565248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658401247, "uuid": "0c7490ab-e1b3-43da-966f-185f3086f217", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658401247, "uuid": "cff331da-e6a5-4a17-b669-f541a20996dc", "value": "SOA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1e5cbae-094c-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1658446159, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658446159, "uuid": "4d294387-e049-4283-9bbd-69c8a1070d0d", "comment": "Malware payload", "value": "204728fb1878b9f4f83c110e7cf6b5b5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Lightning", "colour": "#7AD4FF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658446159, "uuid": "89d72f09-882f-4ea6-b6d9-c1ae74f47afe", "comment": "Malware payload", "value": "48f9471c20316b295704e6f8feb2196dd619799edec5835734fc24051f45c5b7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Lightning", "colour": "#7AD4FF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658446159, "uuid": "77a7a753-2c89-4cf2-a75c-62b51fed107d", "comment": "Malware payload", "value": "cce00f83b70839ea9d42f2fe4ec773e6014ef00f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Lightning", "colour": "#7AD4FF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658446159, "uuid": "fa5e07c4-bcd1-461e-95ae-1de18817b03a", "comment": "Malware payload", "value": "77f64128b03326f26d622f226316fcadc0102755534ecdbe02cb6e0f028b930f3695fbc1716a988720f1efc83584d595", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Lightning", "colour": "#7AD4FF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658446159, "uuid": "5f7f1f5b-a70a-4d34-81ec-c799960b7ca7", "value": "T172733B4FB1A258BEC186C974075B72BA6D7234B863126CBB3540DB742506E345F1FFA2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658446159, "uuid": "5abb481d-7cff-45d5-8d55-6cf23d6dc121", "value": "1536:DIu+9WjgzCuN04fRI2Vunf4PD+1hDRFftZ/u+IHMCDjeR:DIu5k1NzD6DR5XCDje", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658446159, "uuid": "06e920cf-2d38-4528-8539-8b9368947576", "value": 80048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658446159, "uuid": "deaa529d-3d62-484b-8273-7f1362b0ce0f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658446159, "uuid": "6a1ba9e5-06b8-44eb-a91f-ee09214ad327", "value": "48f9471c20316b295704e6f8feb2196dd619799edec5835734fc24051f45c5b7.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8817d947-08e2-11ed-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1658400455, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658400455, "uuid": "8139e397-5121-41a1-9cb7-de8254aebc79", "comment": "Malware payload (Formbook)", "value": "74ccae3c6c0d1cf7ebb9090f8515a2fd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658400455, "uuid": "66bf9641-e6f7-4eed-b6e6-6aa1673d108e", "comment": "Malware payload (Formbook)", "value": "49817f75e2b8b7c17a7a5ac5a6c631023ecb6071d3936a478acd008564af137b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658400455, "uuid": "e8aa8617-1276-4c2d-a69c-7a1ac01683c5", "comment": "Malware payload (Formbook)", "value": "b341615b1383833cd8b2316a4a925f5fd3b22a4a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658400455, "uuid": "921a5e93-2c3b-4eab-ab1e-80c4cb6d7f78", "comment": "Malware payload (Formbook)", "value": "c4a4b02a542fdd5c07c69cd41a2b7d8bcfa374f83c92219f80128a4f3cc06cfa40a7c0028655892c9d8296c47f775dcd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658400455, "uuid": "51dceec1-fd22-4cea-93c1-82a7258d33b7", "value": "T106C4026295104FE0FE6017B2541AA9332E4CEF32633958E924F43E3D723664E16B377A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658400455, "uuid": "fad1750b-fba1-4c09-8e7b-b0550fcfa43b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658400455, "uuid": "3f0e5450-26f9-4faa-a971-93086822383a", "value": "12288:jKfqt4I72oJrG3eIs9FeO9vAnhnf/zGdy8Rv:jP4IKoJ27eYhnfqge", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658400455, "uuid": "1ad22d59-a1d0-494e-99aa-f843a412fdad", "value": 587776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658400455, "uuid": "cbea4083-c0f2-44aa-92aa-af5db488a837", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658400455, "uuid": "b20c69d6-c1be-454b-881a-6db43aae8ee7", "value": "SecuriteInfo.com.Trojan.PackedNET.1433.21982.25112", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6774bfe6-08df-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1658399112, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658399112, "uuid": "1be0bb5c-79ea-4192-9201-19761901a45a", "comment": "Malware payload (Mirai)", "value": "3e65d49d17f338c69790aa37eea582dd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658399112, "uuid": "39478bb7-5c81-4380-b44e-616d600ecb9e", "comment": "Malware payload (Mirai)", "value": "4a324b4572889fd7e47995c0a61cea2c14514980c35e21b999c30d313b5a3cc6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658399112, "uuid": "a930ceb5-845f-452c-b2a1-50efbb1f44de", "comment": "Malware payload (Mirai)", "value": "5e2d9626ec8d14cf08e7157cc6b3351309738e6e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658399112, "uuid": "11a32a58-3046-47e5-b2cd-8e32205774b4", "comment": "Malware payload (Mirai)", "value": "beb15a83f2a1dbe179ef09e3089025b6d90c9f17ae236dab22b2253944a30a011c9505242a3cdb7b55df39f4a4c1085e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658399112, "uuid": "0ee94c6e-4b38-4a25-83a7-2b35e45a20bb", "value": "T1F8133935BA361E17C0D194B521FB4B19B6B152CF26E4C61B7D730E9AFE61A406803EF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658399112, "uuid": "1b45e569-b7fa-44d9-812c-4da3c73e7dfa", "value": "768:ndotWMNJUgHSzqoagiZWECLABLO+9bcLGkwtm:ndKWMN5yzqodiZ5tttm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658399112, "uuid": "eb659aa4-3b3e-4c62-8c4f-9aec229e87b3", "value": 41992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658399112, "uuid": "d9d1dc04-50fd-4a22-a3d3-cdfe999dfa0f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658399112, "uuid": "1fe3c41b-0a4a-48d3-9d9a-f9d5777508f6", "value": "3e65d49d17f338c69790aa37eea582dd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c944454-08f9-11ed-93bb-42010a9c0043", "comment": "Malware payload (Gozi)", "timestamp": 1658410287, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658410287, "uuid": "e89f29ad-b893-49bd-b7aa-f981d789744b", "comment": "Malware payload (Gozi)", "value": "9be6351fd088d3377cafe3697a7f7f6f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658410287, "uuid": "4c806181-b94f-4cbd-8870-ec1b3a9bc75a", "comment": "Malware payload (Gozi)", "value": "4af446399089f97a55c4d04056d178e78ce1cbcf8b67714d5f3672c51a1c8eb4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658410287, "uuid": "5ec72bcf-8f98-43ad-9f8a-a536fa44615e", "comment": "Malware payload (Gozi)", "value": "e8c0cb42cd5af7e5b4c458268faafc2d147f5ca9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658410287, "uuid": "6d9a75c6-0550-428a-beb6-3103b268a042", "comment": "Malware payload (Gozi)", "value": "667ae52e3dd3b39bd8caaa9e223fbbbaad2aaa3a994544083bd7b9a6c3a32e13353b2cfb6a9901b0e4dc79cdbca01ede", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658410287, "uuid": "3934a3ef-561c-4612-b808-fbcaba70f2f8", "value": "T1E3246C6AA3E51199E96BD6B5CD53D217E7F334492B24C30F53B0CAA66F47722B21C302", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658410287, "uuid": "cd138610-7732-422b-a717-9d32955c49e9", "value": "6144:yOZiNwkzdjpi5azwE2uP3qqMFTXvAe5LjwNq:yHwkx9cazwE2Y3q9TXvAbN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658410287, "uuid": "7c19a600-1ead-4540-aacd-8db808294e12", "value": 220672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658410287, "uuid": "a55ca3a7-031c-42b4-8460-f16ab20e3701", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658410287, "uuid": "405f64c0-d360-4c20-93d8-c14815a44f2e", "value": "d900000.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2eb54185-08d9-11ed-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1658396440, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658396440, "uuid": "1a3efb23-2579-4240-9af2-d280eb92ed39", "comment": "Malware payload (Formbook)", "value": "fec1b4d49135dea537824b8f8108e727", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658396440, "uuid": "ac13fc28-ae02-4a35-873b-dc22398bfe57", "comment": "Malware payload (Formbook)", "value": "4b040cd26bcf5a1bbedf762947faa295769ba625fdc334765e732fae81c76ad3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658396440, "uuid": "78166996-3368-4be0-ba9e-70d15f94cec3", "comment": "Malware payload (Formbook)", "value": "5ba47df1eac70ebebad22fd13524fcd6a1cce61f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658396440, "uuid": "f055b9d6-60fb-42be-9ab9-74499ba709f7", "comment": "Malware payload (Formbook)", "value": "ef5c7236d09b02fc4a43814a74de3fdf07fddae0be8b2d2fd90aa750a78272764f5637f25e0487ce4d48e21116a01381", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658396440, "uuid": "a83f5ff2-7761-4a79-a795-98167661054d", "value": "T100C4E054F6D9C13DF4FBCB7C0BE4A57466F5E6225508E87E2DA01D8E0A22FC88A52533", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658396440, "uuid": "006212e4-2c45-4b89-a6e2-a0e289ce9cff", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658396440, "uuid": "e145141b-3cbb-4e0b-9fa8-20210ce3dc82", "value": "12288:ELP0ubT2iNYF/sQmGwwImcyWogXx9QOwxBTZuou5xNjx84CQo4:EbFT1As3GwwIXVlQF4ou5xNjxG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658396440, "uuid": "3c162465-649b-49ee-a819-5b426a4eb4a4", "value": 590848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658396440, "uuid": "0e826512-566c-4e53-aff9-aee9d54be6ec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658396440, "uuid": "304a81eb-77a2-44f9-9f76-362e12a8762f", "value": "Payment_advice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f9c6b17-088b-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1658362887, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658362887, "uuid": "e64cc743-695a-42c3-a879-4c4041d78d6b", "comment": "Malware payload (Mirai)", "value": "1b005b9b71ec385468f24ada231fa96b", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658362887, "uuid": "51764afc-af33-4f90-8430-0a7e4f9dbe72", "comment": "Malware payload (Mirai)", "value": "4c062da4dc37045fe851ded59753c511fcea6ae36ef5b8981d616e9adf45a150", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658362887, "uuid": "b91c3d26-c9ed-4a02-9634-978de6c60e91", "comment": "Malware payload (Mirai)", "value": "2d680780d0f67123abff5f1ac7ebb282fd0bf503", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658362887, "uuid": "8d733bfb-5269-4be5-9f2f-f195ab5beb5b", "comment": "Malware payload (Mirai)", "value": "820c0b53123fcb8d59ab06df857b2c1717b1ccc7535c825dcf3ea72c88099186ad4a0126d15437043890661a1770b97e", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658362887, "uuid": "e3743d61-53c7-49e7-b8fd-f9f63e2060b3", "value": "T18692C0B2DC4025FAD4C05C35C168D7C73159A6759FA7B0AA2A2547E9BC0988307FA2ED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658362887, "uuid": "30d1cd5f-5ffd-4228-8a7b-71f1e20a2b4a", "value": "384:WrZrsBiIms6MM2vRnuFZJGSBY7zSzckCnmRalmdGU5ESt:W1QBiImdDiS4e83UNt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658362887, "uuid": "fc96f4f3-76d7-4e6c-8cbc-d5decc344f3b", "value": 21148, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658362887, "uuid": "d1935b64-6bef-49ad-85a2-4443e19a8b8e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658362887, "uuid": "03c82d9b-5444-4e1a-8512-19ab34ec629d", "value": "yakuza.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1eb8794b-090b-11ed-93bb-42010a9c0043", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1658417888, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658417888, "uuid": "f0ce8a7a-83fd-4b18-bdd6-c483f7848442", "comment": "Malware payload (AveMariaRAT)", "value": "c84fcfa570bc983524fa53c5cd7c0f33", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658417888, "uuid": "838e170a-af85-429a-8570-ee5b1e2bee49", "comment": "Malware payload (AveMariaRAT)", "value": "4d016072f39a1b5adadd8ca8a13255984a8a5ee594d7a4a1f35f05f1b62bf2d5", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658417888, "uuid": "f0954c39-b515-4f3d-a196-40f3b3ca7a64", "comment": "Malware payload (AveMariaRAT)", "value": "1be8210a42e4deab21e8108abdf130b4f2d10077", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658417888, "uuid": "03de898a-9e3c-43fc-a391-2993ee4e112d", "comment": "Malware payload (AveMariaRAT)", "value": "5bc8e8a68b8294f5b0e13ba2f1360b7a2abcee92d29c50ee1d44a3ab311b4c0eb76358255152d7caee8bf9abdfbcaf89", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658417888, "uuid": "1fdbc1f3-fd3e-4dec-918e-0e2717a164b2", "value": "T102B4651C67814AF1EC0DE1744AC4C535EB120EC65398D5ED5FAEF9C683798A29C30AEE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658417888, "uuid": "1ac279a3-8308-4143-bd26-4564ed8ae776", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658417888, "uuid": "2a4c212c-7fc5-4424-8821-c45066670c0f", "value": "6144:Hmcicqc1F+3Sl8r+7YpjSYbDS51xbtt2SVqewE/0eX3Mpx/fBkhN40ibH+sYNRLI:Hmcidc1F+vE8eX3MB0RRL8t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658417888, "uuid": "4f4e3d15-f9ca-497f-b85c-5cc1d46ee4ef", "value": 542720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658417888, "uuid": "4fdff64f-ada5-4ae4-b32a-c47ceb5c56f8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658417888, "uuid": "33424cd5-98de-4bb7-85d3-1a8d9579cc40", "value": "SecuriteInfo.com.W32.AIDetectNet.01.17077.20244", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d1f873e-08b5-11ed-93bb-42010a9c0043", "comment": "Malware payload (njrat)", "timestamp": 1658381136, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658381136, "uuid": "34fbb051-36b9-4f39-bbe1-c4ae5f606e20", "comment": "Malware payload (njrat)", "value": "b45d6614550a40d86cf25c0abca01ee3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658381136, "uuid": "ca8dd619-0e0b-4994-85a5-0cd8f5c33b58", "comment": "Malware payload (njrat)", "value": "4d443d374a1941217335cca576c402e756c1ac5f56f6e0e33868ddef4672c82c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658381136, "uuid": "52d732fb-24ce-4864-be87-b24efae846fa", "comment": "Malware payload (njrat)", "value": "cb96da4fd22d2fc5e652b13622937f51966bff0d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658381136, "uuid": "42092221-ebbb-4b7d-a625-d2bdb11174e9", "comment": "Malware payload (njrat)", "value": "f5fef1d2d78baa3a196f4254541f8edcee5d9ac5266a97d1960f9c5553f7eb59647aaf77148e58dec54e665242eb687f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658381136, "uuid": "1ca7580c-202f-4242-83db-cf51b45c0a8a", "value": "T182B23A0E3FA98856C4AC17748AB5965043B491870423EE2FCCC564DBAFB3BD91D4CAF8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658381136, "uuid": "f3673f7f-1880-454a-b997-c51d57a3837c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658381136, "uuid": "b2710c8c-56af-4cb5-8a30-4e15333466e5", "value": "384:sc6CqbFYh3odrVCGiHssDB4b6i6fgpEupNXRmRvR6JZlbw8hqIusZzZOf:rIU0tw3RpcnuL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658381136, "uuid": "0fffc1b4-17b8-437e-aa36-b88de239e0dd", "value": 24064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658381136, "uuid": "ec78141b-e96f-47e4-bdd0-624904082aad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658381136, "uuid": "831bd59b-315e-410c-abf6-dedf6878b1f2", "value": "b45d6614550a40d86cf25c0abca01ee3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de90b00c-08ee-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1658405754, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658405754, "uuid": "f3a1983c-c606-4e7a-bb03-36271b4486c0", "comment": "Malware payload (Mirai)", "value": "e672e65aa181fdd1c72fe812327b9161", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658405754, "uuid": "c27727ee-5690-4844-ab08-076127c7285e", "comment": "Malware payload (Mirai)", "value": "4e6be382f9c8694820486f8301c96f3b148598884c01efd069405f66ea1d3fd0", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658405754, "uuid": "18ae9efc-420c-4ca4-8057-ac5ea516b696", "comment": "Malware payload (Mirai)", "value": "544840a08b9c19308d576ccd41effae93c7931d7", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658405754, "uuid": "746ae1e0-bb93-4c33-90dc-40be17abbf8c", "comment": "Malware payload (Mirai)", "value": "13e00c80205f3eef1f9ec65a48f140c9c7d63f6bae357b9717ed12bdd60e05f56492e757405a1cb69269c44e1c394f92", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658405754, "uuid": "cd4588b1-5c5a-48eb-8aee-be8c0f5d5c6a", "value": "T174B2E172A1CF1B91CC888235EABBB6C842D167D093CCC9F4F88D55727DF15730A26594", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658405754, "uuid": "b4a66cc9-1304-4607-9365-d9f4830d6cf7", "value": "768:QZguSn6cVt8mdFVj7ZHYGqMvmgdwNHB7NO+MAlKxh:Got8wj7ZHY1pB7EM2h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658405754, "uuid": "f9b69227-5f51-4e78-952a-8d94229d6310", "value": 24780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658405754, "uuid": "7671891e-d150-499f-a6ee-404565da83a6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658405754, "uuid": "0998803e-d7df-43fd-9803-0e94de797b03", "value": "yakuza.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44af1c23-08c9-11ed-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1658389605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658389605, "uuid": "bd5847bd-5ed1-4aab-bbe1-ad466780b06b", "comment": "Malware payload (Formbook)", "value": "68730f398dd00ee7cce6f3c630879f62", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658389605, "uuid": "26b3faf3-47b6-481b-a3ab-6bc671cef4a0", "comment": "Malware payload (Formbook)", "value": "4eeef4e2f14912473e3838a5658cdfbf4a33f8cb8aace3ec630f483a5583180a", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658389605, "uuid": "eee1c1f9-a252-4aa0-bc7f-5fa7d9f05b91", "comment": "Malware payload (Formbook)", "value": "11ee310745c8c21efb005236cc18494746021b73", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658389605, "uuid": "a05b5352-3778-49df-a36d-b439161a7965", "comment": "Malware payload (Formbook)", "value": "501c0865c64418f789b4ef2cffa11efcfc9b8bae3228c169b22c23bcdd953ea916af855c2b0ff992806745927d5dc942", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658389605, "uuid": "c89185fa-95aa-483e-b47a-d83e8249c8b2", "value": "T1AC341271B69406BAD87386F64721ECA4D835FED49A8BD7CA11F8F41C24F2CDDD248648", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658389605, "uuid": "575ae1c6-f204-4dc8-b2c8-14a477012c5e", "value": "6144:wbXFDBy5mTgVIRmq+hCS/kbzxpLx9bxT:wfy5I5RN4kblJl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658389605, "uuid": "217388f7-329d-4079-a3ca-45445ddc04e3", "value": 242688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658389605, "uuid": "94480cec-07f2-459a-b155-1226d6f359fa", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658389605, "uuid": "4cec58dc-2fb0-4876-9556-471f864add40", "value": "N.RY2121.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c9d7bca-088b-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1658362882, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658362882, "uuid": "b7e82a91-6d32-41e5-8f77-3d12d2d54672", "comment": "Malware payload (Mirai)", "value": "8476865e98123f91aeda2632797ce767", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658362882, "uuid": "2cbd8cea-0924-41bf-81ce-2cf2b3400ab4", "comment": "Malware payload (Mirai)", "value": "4fcf04377397ee1d27d2cef0cf100a64157e71317ca8fdea14c83d86032c5570", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658362882, "uuid": "17d526cf-763d-42db-a766-a5585abf7c05", "comment": "Malware payload (Mirai)", "value": "044e407fb3a6d1e5021f201720b00dfebf89cfef", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658362882, "uuid": "dd5f3235-16a1-4374-9d7c-0aa7cc5a80f8", "comment": "Malware payload (Mirai)", "value": "7a7b74393cf6f2e246570febb5435c576ce916f8723325157933fd0a6a3d93953796de963450bb531ecabb15c7eb7066", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658362882, "uuid": "8beb901a-cd9f-4b5c-9f63-162a7cdd44fb", "value": "T1FAB2E1F642CE2486CA14827F96CF81D053A49EB5B3C7CAB0B56D2581BEF1B2315BF520", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658362882, "uuid": "cd450444-43de-40de-a5ad-84f1288a563e", "value": "768:SZguSn6cVt8ddFVu7kince2KMP2GnBYKxY:Eot8zu7kicWMe+BY2Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658362882, "uuid": "70673856-0b0f-4310-9bcc-0241c5648997", "value": 24804, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658362882, "uuid": "77c461cb-da21-43b3-8840-405adea6be90", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658362882, "uuid": "ec27190d-d10d-471f-bd6d-0f456f00dc66", "value": "yakuza.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64cb8f80-08cb-11ed-93bb-42010a9c0043", "comment": "Malware payload (GuLoader)", "timestamp": 1658390518, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658390518, "uuid": "b68b20a2-b108-4e92-bd7a-4f2668134bfe", "comment": "Malware payload (GuLoader)", "value": "6d3b574bf4279dc9f9dd289369e2a035", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658390518, "uuid": "25d6fb65-66b2-409f-8c31-7db5ecea85db", "comment": "Malware payload (GuLoader)", "value": "4fd9fb1b45e80653415a082d364ad0210f9a9801fb33fc4a044278aacd3d00de", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658390518, "uuid": "129e0313-a4bc-4162-af49-b53811d30f51", "comment": "Malware payload (GuLoader)", "value": "c0ee49a70d077b547c7ac2e57e3c97a2f9b2a345", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658390518, "uuid": "611533c0-04bd-4692-8d5f-6fd7e120a3bb", "comment": "Malware payload (GuLoader)", "value": "f4b8a86099825df3cf9c710c80b8836a9772e6ec7bbec25b446667ef0f88c58681e30702f38dfe723f6980aef51a8520", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658390518, "uuid": "94e13541-02a6-49bc-a732-5257d9fe68ce", "value": "T17A3429D0A53D2244FA051ECADE8FF6B50234F13B0FEE6B1428568E49E7B2654C6D6E07", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658390518, "uuid": "65a09d25-f53e-41a6-a7de-1abb24b4b58a", "value": "3072:MHLZrAmLzN4+9B3OzzSdI1tFigPYFsFI+5aPaSQm4TbdSz/fSwCmw1VLaNi4VOKJ:cZrAmXuEOpQtzyTSuVLaV5kD1yz7AL6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658390518, "uuid": "2a813e3d-4011-43c7-bdad-645fd82f0d37", "value": 253023, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658390518, "uuid": "778df79a-0983-4924-9023-9bced344fd29", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658390518, "uuid": "b0f9f691-7176-469d-b3ab-badfa9fe3610", "value": "#2022078298.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77909358-08df-11ed-93bb-42010a9c0043", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1658399139, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658399139, "uuid": "0f93bbc2-9678-424e-bcca-269fa4ec073d", "comment": "Malware payload (SnakeKeylogger)", "value": "9d520854cb2dc62277d55958732fc16e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658399139, "uuid": "ee083ed7-dfad-4e1a-9861-4d13991fde57", "comment": "Malware payload (SnakeKeylogger)", "value": "50da774fda04ec1034035862f80ea8933397e34b66ac58c239c369836e341be0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658399139, "uuid": "43834f7b-afa4-4414-a526-8ad91e1f1302", "comment": "Malware payload (SnakeKeylogger)", "value": "40923fb84b61b9905d7b0f9886c259ebbd6dd0a9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658399139, "uuid": "e84c7dd7-73d4-4dca-bdb3-d5fed432dacf", "comment": "Malware payload (SnakeKeylogger)", "value": "bf4bb370cc438b33b9be9a83a5bf609d1ad51cc06c1d7470d69209ea91f875f6b7a1d9298bd0c17903f04e63c8d9eaf2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658399139, "uuid": "476ac278-d246-463a-9298-52723dea7268", "value": "T1ABC4013370B7E612C93817B380D352980BB2760AB173E11F34DE618E86E67E65A817D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658399139, "uuid": "1f915715-ea15-496d-b59d-703b8f7c4eb4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658399139, "uuid": "5c9886ad-c0ee-4452-921f-3b8698b63a2a", "value": "12288:9pgg31hqx8oALbZGTt3Li7MgPDbOjy9YSuKhglOnb:9vqx8bZGE4KAy9YdFA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658399139, "uuid": "2c9d6552-6f78-4558-a17e-858249ccd4b4", "value": 565248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658399139, "uuid": "8ed1f320-a5f3-40cb-91f7-79574cb08574", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658399139, "uuid": "4b6b2ccd-361f-4c89-9c87-f84d5709ff25", "value": "Scan2347758.PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6d0d45a-08cd-11ed-93bb-42010a9c0043", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1658391514, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658391514, "uuid": "f396fca0-77e0-4a8b-b5b7-016c5ad0d248", "comment": "Malware payload (AveMariaRAT)", "value": "971225c4ccf1772b08b0e04840ab6539", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658391514, "uuid": "5c192db0-486e-45be-8f7f-0286a900dbd1", "comment": "Malware payload (AveMariaRAT)", "value": "516b13e41c4f2934eb5793c55d682729569733343e724918a25dd2bb57fcb9c1", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658391514, "uuid": "09b2c6d3-7515-4881-a27d-3c80d195914f", "comment": "Malware payload (AveMariaRAT)", "value": "898323f8e040768b62082df5d1e02c5c0fafa3df", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658391514, "uuid": "a265019e-768b-4e7c-a88b-76d088b54fcc", "comment": "Malware payload (AveMariaRAT)", "value": "c853b9360694f2a71a3b6d73b6983cdb782cbdbe0d65a16312619cd503a71203b0612f20904ee6ee03a58b18723bba7b", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658391514, "uuid": "b242e7b3-f8d8-4426-9364-6eb0703c90a5", "value": "T1D355E864B3A51105E9C7A77F73A08B90C8AE3C419D6E97CF4D460AC6CA2D2F479086F7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658391514, "uuid": "2ff7e0e7-406b-45b8-b575-8d2a590f2d02", "value": "4f9b06c7f959cb82e2eb240c2648cd76", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658391514, "uuid": "c2c71c99-214c-4b4b-8cd7-27f306072da7", "value": "6144:ojUQ5EEcm7S00RiTwSltgxCKYPMXq9NmiQBYGhpX8x4MWy1FYCz8hJ2n3C+8Jk7E:q5VcmD4pa7+o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658391514, "uuid": "b6abd3ab-ffd3-4247-b7ae-bd3394b0a59b", "value": 1308672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658391514, "uuid": "66a20916-c18d-453c-8576-f1bbc9a237f2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658391514, "uuid": "ae86dfa0-67b1-4e7f-bbad-68b717ebaa65", "value": "New Order_MBT LTD..pdf.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a235b7a-08c9-11ed-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1658389668, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658389668, "uuid": "f9db374e-2512-4685-af75-265d90cf3ac6", "comment": "Malware payload (Formbook)", "value": "76750744561e45e23a3a000719038724", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658389668, "uuid": "daecc9e9-9cd2-4455-bbef-3f21774723ad", "comment": "Malware payload (Formbook)", "value": "517bee5a31361746c8f500b37fe9e13b31e310416e51581a73cab18054db6d91", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658389668, "uuid": "eecc9b71-69cc-4dff-b92e-498575375ef3", "comment": "Malware payload (Formbook)", "value": "fb3dee6d5340817559df657010cee40847d2808c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658389668, "uuid": "99cd329e-2750-474a-b466-22b35a5b414a", "comment": "Malware payload (Formbook)", "value": "b2ef9743ecc921d79362d2a2603e9c20dd38364c3cde35337d982610e6d75d14084e2f3b03d741f6375b5ed8f4bad066", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658389668, "uuid": "88eab6ea-6149-40cf-8bc7-df943faa07f3", "value": "T1FEF34093E90A93F5D83AC33ABC33482127B1EE3B7165163C1665B1693AB21171973F1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658389668, "uuid": "0dd2d544-9ef1-4d59-b507-c6f1659722c6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658389668, "uuid": "5d5c9a4e-242f-4a63-8954-76aac6830a29", "value": "1536:ypGwPsU2Sz2EYC11iviii9hpTQqMUiJCYI9Bt+MQ:i2e11iviiiJ0w6MQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658389668, "uuid": "d418fc0c-2392-4e9d-94eb-175d27dcc213", "value": 171008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658389668, "uuid": "feaf1cbe-17b3-4b44-89ac-06455ff248de", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658389668, "uuid": "89230657-6262-4ffa-8757-272ed9200635", "value": "SecuriteInfo.com.W32.AIDetectNet.01.12655.24830", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b505ae45-0915-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1658422435, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658422435, "uuid": "49abc894-8f4f-490a-ba51-62b56506fa1c", "comment": "Malware payload", "value": "45cb789f389776243bbf983c2bf93cc0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658422435, "uuid": "a203226a-0076-4745-bce8-25d0a0abf8d6", "comment": "Malware payload", "value": "51bf14d4e461aaefa965cfdf611f743634e1a6f7e27e829968494fb4f44a1cbe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658422435, "uuid": "45d2b5a7-e9de-4f82-aa2d-83ba15b0b21b", "comment": "Malware payload", "value": "c533bddd575119b05b5ac86be71661422c2441cf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658422435, "uuid": "8cefe651-8fa4-4f03-a341-1f1e89c40974", "comment": "Malware payload", "value": "9fb58e5fa12d42b5dc0754ca2e04777fa561402ab7fb1bf7e5eaaffe200558c88821147e4ba439d22b95e5eea2e7d180", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658422435, "uuid": "631f073a-27c3-422f-8748-26f74903c8c6", "value": "T1854449C5FB8AADD2D70561318AAF43292334FBD117974B133E2A72351E17AE1EE42607", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658422435, "uuid": "0831ef16-9c77-4a3b-921b-71f8c3484ff3", "value": "e33babf2586c6a0855a7c9af3934a4b2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658422435, "uuid": "23a787d0-1298-42c0-b8a4-f0ce292a3b3f", "value": "3072:E3y6+YbY3FmL7gOnrX79m8/DYGzOYAZCaI5hkl7ugo1QFZwjCAtFeuCJnqir/9py:myS4mL7gQw8wXY95VIwjCGSqq9PBi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658422435, "uuid": "4a23ecf2-1202-416b-a768-7ae16cb6b56e", "value": 257126, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658422435, "uuid": "45c7c5e9-edcb-43fc-8022-2dae5b4e097a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658422435, "uuid": "67045f79-ba17-4b04-a63a-42f577c6ef35", "value": "NEW MARIO FILE.crypted.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11643eee-088b-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1658362890, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658362890, "uuid": "e7bc318a-5e7e-4a92-b29b-32807e92f877", "comment": "Malware payload (Mirai)", "value": "fc3064b9ae22709d2b9e2f2d5f813e95", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658362890, "uuid": "54ddabff-786b-40b7-b6ba-f8321c28f10f", "comment": "Malware payload (Mirai)", "value": "5251b7412a5f0253272dc99ae5e0a16e07d8a207ebb6de38d8b6c237456a4e87", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658362890, "uuid": "4d186e3e-0d5c-42af-bd79-66a086593265", "comment": "Malware payload (Mirai)", "value": "be65f55b3cafeeb8bab2368f2230a6e8e7d448e8", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658362890, "uuid": "9fefdbb9-e4bc-4756-ae50-178725d7e9de", "comment": "Malware payload (Mirai)", "value": "305820b4a3d316aafde1414ce3042341a07cf177f7273dc4c4f0e4bc7b9f02af403d73507ca375e96187436354d66020", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658362890, "uuid": "8aa7c9bb-f973-4af2-b466-487b61a0233e", "value": "T1C8D2D07191000522E2B02E38FD758E5326C86A6CE168B5B4630B66F47EDBC89D7BC84B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658362890, "uuid": "96482ce3-b896-4394-bc2f-1f81d2b8ba20", "value": "384:nQEF0jBcBirqn2QzGpb7Jzvk4pbS+a8QRdLRUkLPdSr1QQ1sAqmdGU5EeCZdlN:V9UrNb7OUbSJ8QHLR5gQQbq3UIlN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658362890, "uuid": "9f23d0ad-6583-4521-a7c2-9b97887bc89b", "value": 29836, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658362890, "uuid": "cde2adc5-c482-4f7b-9c96-39d620998eb5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658362890, "uuid": "d40fabbd-14db-44cf-8a58-c078befd7483", "value": "yakuza.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8f2ee56-08f6-11ed-93bb-42010a9c0043", "comment": "Malware payload (Loki)", "timestamp": 1658409181, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658409181, "uuid": "d019613d-0490-4d72-b2f2-5bb9e5efb158", "comment": "Malware payload (Loki)", "value": "2d2378da4bafe0ae5f9d351e76558d9d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658409181, "uuid": "7c17ee2b-57b7-4519-a786-daa24994d05a", "comment": "Malware payload (Loki)", "value": "52b18494008811d0277d2a3397df855d80a9575c09e11225950fd9f505850346", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658409181, "uuid": "52f0ae73-550e-47e2-9d82-1c9874a6950c", "comment": "Malware payload (Loki)", "value": "f870e5ba57f843008ac2d03a43a8409290e4b833", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658409181, "uuid": "f04b9554-56a5-4637-b9b0-d21e03b27ce5", "comment": "Malware payload (Loki)", "value": "266102a3532c45189561b146737c9ed9762fa48428568118c504169227736ae47e9e4c7e10c561dae28f6db1340963ba", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658409181, "uuid": "9babf32f-7838-4d24-b3b8-46d09bf96b2b", "value": "T1CAB4F13372FBE915C63847B240D3528817B3660EB1B2EA5F34CE665986D17DB9A403E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658409181, "uuid": "8ed85103-0c2d-4a62-bfa1-80529e58319c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658409181, "uuid": "60571486-3e2e-4e96-a953-a35b4423f7bc", "value": "6144:z3KEg6vEEE1jPm31hjRqgu85yasjt7JJz6tyINl78/SX0l08iQs7nW57ILYe+G18:zfgg31hox85UjtttL/SL8SW5ksUu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658409181, "uuid": "30649320-4199-42cb-81cd-1bd4e30eda0b", "value": 535552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658409181, "uuid": "c1dacce3-945e-4a55-8a17-e51086924bc9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658409181, "uuid": "514c2e82-1a24-423d-a114-95af727827aa", "value": "RFQ1dNv8HlLMnXf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d645dbc-0908-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1658416678, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658416678, "uuid": "451d4068-671b-47af-ac22-515ef9871d5f", "comment": "Malware payload", "value": "72133a85c2b320e6b082cc2059f69d98", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658416678, "uuid": "7a212996-6e11-42cf-a62d-2a32c3c8c5b6", "comment": "Malware payload", "value": "53a9cec80df65b5811fdc36d587d8dbd3d170371f5bcd33133d71092c02b81dc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658416678, "uuid": "57a743d8-8a3f-4269-9e9a-3aab371d36df", "comment": "Malware payload", "value": "8ed8b2d1ecc0d49d9b3c1906965c8db69e58349f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658416678, "uuid": "5a8896c1-e299-4fd8-88f3-4a873fca8560", "comment": "Malware payload", "value": "be578415c37627b2071b2dfc35aa942b9202b67c7ca757e6ebef8899052c9d0e27dc9b6e83986a48571ff2a1a8e42bab", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658416678, "uuid": "6e7dbeb2-80e3-436f-9525-0a9aa4533328", "value": "T1FF945A207BE48726F1BFB3B1D4B21059C7F4F056B19AD38E5C85129E1C23740E766AAB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658416678, "uuid": "a2131b75-f13c-480e-ab8f-9f2326e80afc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658416678, "uuid": "2afca84c-87b7-45be-af64-d70049c9348a", "value": "6144:xE0+6Pa/l2eZ9kxzFbXklPIwNCOaUk1WCqkPPljYYCyUp+JwL:yB9AkbC/qdtO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658416678, "uuid": "0650d441-3b75-4792-96e8-4723717f620f", "value": 431104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658416678, "uuid": "43864183-3613-4aba-af69-e2d5626e01b6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658416678, "uuid": "bb01e3ba-6edc-44cc-8036-55f95a85c955", "value": "Remittance Advice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d894d478-0927-11ed-93bb-42010a9c0043", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1658430226, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658430226, "uuid": "16900751-ab5d-4e28-bee5-4b05b93440ca", "comment": "Malware payload (SnakeKeylogger)", "value": "728346de3e8b54a62cbd098877022575", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658430226, "uuid": "0bec4f04-e257-4b6c-8909-3b7cc82860dc", "comment": "Malware payload (SnakeKeylogger)", "value": "56592952894bf0d4b991d0bac813dab7d21517c5c0c79cce2faf8a50383cc3bf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658430226, "uuid": "7f460e54-5357-4ca2-933b-d4e4cc956b9a", "comment": "Malware payload (SnakeKeylogger)", "value": "d4b2776d1aa8cae24d888c2e3a8a2057cbdc57cb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658430226, "uuid": "ed405954-b8b2-4684-b55a-6841236cac9d", "comment": "Malware payload (SnakeKeylogger)", "value": "3a6166e8f47474420a742d5d22fd471cd653cfee2e610ea867b7fae83a5c97a1c3bec368acc82f06f21db9d13d22273f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658430226, "uuid": "1048d3a4-ec81-4697-9040-dd7140eaa8b4", "value": "T1BDD2BF1BF7988E39FEB207715E635300CB78B4529C66DB6E7081554A7E333A20993774", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658430226, "uuid": "cfefb81f-4df7-496a-97b4-e4a3b623e727", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658430226, "uuid": "660c3d48-a758-4c27-91de-8529fc1e79ec", "value": "768:s+ECNf7ojFYwQ7XvLWRgcL0ST8iNxy2m:s+Esm7oWRgcL9HNxvm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658430226, "uuid": "ed418842-dad4-4df0-ab0a-ccb57cce2a0f", "value": 30720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658430226, "uuid": "297dc30b-579d-433b-9eb5-e26cb2b8dfa3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658430226, "uuid": "dedddb89-dbfe-4ab3-8d56-5a24a3b6d252", "value": "854F1E97-5DBB-4A87-A566-33D9012B05E2 pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45380965-091e-11ed-93bb-42010a9c0043", "comment": "Malware payload (RedLineStealer)", "timestamp": 1658426113, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658426113, "uuid": "31400cce-7ace-40dc-ab70-495fdab04175", "comment": "Malware payload (RedLineStealer)", "value": "92f80d505ca04fe51dcf28a3eeced151", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658426113, "uuid": "c9077887-b58c-49c2-a2a2-e0a56754eb13", "comment": "Malware payload (RedLineStealer)", "value": "5cefdb1d67b47e05fe7920b76e1c75302954243a07192f3cf16eb89d1b6adade", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658426113, "uuid": "d4aca82c-4a0e-462c-9a4d-8b71972f91c5", "comment": "Malware payload (RedLineStealer)", "value": "81341f4bb1761d487667d933a0e7470a4f2920e2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658426113, "uuid": "e65a789e-28ba-49e0-9dcf-b1bc3670646e", "comment": "Malware payload (RedLineStealer)", "value": "ebf9300a3f55ba1275cfa3e37834f4d9fa0044581cb8e2ff7a703ebb9cf559aa830e74d3da2c4408a0287024e5782039", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658426113, "uuid": "26a0563f-1234-481f-9231-ab7b07bfe640", "value": "T19154E09272E0C871D4A25B304470D6B25A7ABC33B6F8D14B77983B6E5E713C12679B23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658426113, "uuid": "1298ac6d-56ac-4ab4-83d7-acc5a7661544", "value": "401da744a568f91ec17ba84225e05b40", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658426113, "uuid": "9c03bdf5-213f-4926-9dc5-0f54751de743", "value": "6144:Nua/T3QDC0JZlt3Z+4QnaAu5S0E4DuH8aMCgOL4LVyzp:kgTSBluNIY0nucaMTLVg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658426113, "uuid": "4fbeb4d0-2703-446d-89c9-84a52211105d", "value": 302080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658426113, "uuid": "8b431678-27e2-4a51-9ba6-64ce3649e4b5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658426113, "uuid": "faf7c329-c49d-4a9d-b00f-8e42e0989923", "value": "92f80d505ca04fe51dcf28a3eeced151.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c8b9771-08e9-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1658403281, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658403281, "uuid": "f27a55ec-8234-4d14-99d8-f3da72caa4cb", "comment": "Malware payload", "value": "f50b1ccf5d96855d0f9c55be92e3e2e2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658403281, "uuid": "cc8c8e54-ce42-4440-a76f-4c0ca47e18ba", "comment": "Malware payload", "value": "5f414f3e4cc5e1520aadc9df18cd31386c919791dbc73a0d0faae885b22dda02", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658403281, "uuid": "9b1a2858-3c9d-4e69-883a-fdd5d8647186", "comment": "Malware payload", "value": "6efe92a5ecd5ca8edbc5365e9b85b6eb1407f35c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658403281, "uuid": "239e2a57-3c7e-4fb6-9bd9-eb588c8e62d9", "comment": "Malware payload", "value": "4a207718cd556a2d1d5f0ab313038131be9c9b2f22c2901c6892cfc36784eff6b57b1d92e4878fff4eef1cd453a10b33", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658403281, "uuid": "4179c4c4-b0f1-410b-b50d-1371b7ffb3fc", "value": "T120D1D410CBE84B72CD664731A8F373415A39DB06A99A8FAF0CD8921F9DC3B444A13A70", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658403281, "uuid": "bb0e9efb-a500-4a6e-ba63-dc0331ce65fb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658403281, "uuid": "2b3f7e6b-abca-4aa7-952b-b0c0ebdccbd1", "value": "96:rolZGGJOWZDc63twpx0QPD3EDd0xtTh9MiWJxgzNt:ror8Wx9wp2oEJ0xtT7PGi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658403281, "uuid": "06f0099d-4b91-4d99-8773-2a1991953f13", "value": 6656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658403281, "uuid": "b6f90de9-4484-4676-99b4-1f64e76d1789", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658403281, "uuid": "25456427-1b64-423d-99aa-ae1b2414968c", "value": "f50b1ccf5d96855d0f9c55be92e3e2e2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "889f68fb-0906-11ed-93bb-42010a9c0043", "comment": "Malware payload (RedLineStealer)", "timestamp": 1658415918, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658415918, "uuid": "9ca084c5-1a6f-49ad-bfac-315888023c4b", "comment": "Malware payload (RedLineStealer)", "value": "46ff72930e3bac49be984b479a9883f5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658415918, "uuid": "9556399b-debc-49c3-adaf-0572ed57cef2", "comment": "Malware payload (RedLineStealer)", "value": "6039e1c73267eceebf23d4dc2441efcbae8cce29a540fb699895bd728245aac4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658415918, "uuid": "382b93f2-c128-4bb3-b700-3fb808fa647d", "comment": "Malware payload (RedLineStealer)", "value": "5f6ba5d81be50bad98d54d7e98940946400ded3b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658415918, "uuid": "2d634c5d-6a5d-4039-908b-4b0f816c4336", "comment": "Malware payload (RedLineStealer)", "value": "b0ae107486cd7ec2ca250852ce979199b6f63131fdd31c0ea4c1e2a5db58280062d493eb7fcc72db422497a4c24a46ea", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658415918, "uuid": "21b58e66-b9b0-47d1-8d2c-0266292aef79", "value": "T1B754F1527AE0C831D4E31A39687186A65979BD638BF0884F7394377F2E702D07A74367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658415918, "uuid": "f1c33c5c-5b7f-4fcf-8a91-8caaf59fc3c3", "value": "b5d67d85726d53f797f7d82017938c03", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658415918, "uuid": "9b64a9c7-642d-424b-981f-9587b321341d", "value": "6144:nER0l+qp95hmdOhIeIci72QfIXP0W7M2ARYslmbW:ER0kgm+hi72fXPv7ca8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658415918, "uuid": "e35cfa42-ebee-46b0-84fb-7377d344947c", "value": 295936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658415918, "uuid": "e44ce62c-573b-48e1-8ad7-46c8593cc224", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658415918, "uuid": "716d59b8-6cdb-48ad-a747-f07e529e3bde", "value": "46ff72930e3bac49be984b479a9883f5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a603251f-08ec-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1658404800, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658404800, "uuid": "a3324ea8-1e6a-4e4b-9e8e-9d921d9efc8e", "comment": "Malware payload (Mirai)", "value": "76bec83864675ae24ff29b974cfa6e7f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658404800, "uuid": "9c353d58-2c79-4a79-af98-a6bead6a7535", "comment": "Malware payload (Mirai)", "value": "60453e68d1bf127f61ba05788368faeef26e67f73e8ac843a1ba08b54796e81f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658404800, "uuid": "97c00a87-f999-43f0-99cd-149cb532df27", "comment": "Malware payload (Mirai)", "value": "ce8aa3a3d11fc3ff87bcb250a54048f81c811fba", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658404800, "uuid": "81434440-6f11-4aaa-a594-9ffb86cea065", "comment": "Malware payload (Mirai)", "value": "522f1548ef0cd505ccacdc5086c6c9203b4fc49b48b26437eb8c24af78d1f6c65ee27a3d6363945a78d5d87486d75fb6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658404800, "uuid": "79d3fd7e-bd08-426f-8c71-4a98c1baa962", "value": "T1D623BFACB8008507BDDFA3B955B3C8EDD3296AB7DD6874B3DD71509830961EA390C9C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658404800, "uuid": "6d731644-8395-43ee-aed3-994db87e4d0c", "value": "768:LkMTOOQqqqeYX+6g+ANbrL6v58k3SZB/KoX83BaSlZyqHWVcKCTwDtdRc:LkqqqQrL6R8kiZ5KowBaSlkP3nRc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658404800, "uuid": "e0500e58-ec03-46c9-a67f-9538a3c94abf", "value": 48328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658404800, "uuid": "27a0045c-0d8c-45af-ad80-7046f338e637", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658404800, "uuid": "2c8edc06-8610-490d-b4ea-fa1b2a050a93", "value": "SecuriteInfo.com.Linux.Siggen.9999.10786.24567", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8c70573-093a-11ed-93bb-42010a9c0043", "comment": "Malware payload (RedLineStealer)", "timestamp": 1658438413, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658438413, "uuid": "92a61c3d-7a2d-4fe2-b7c4-4bd0ae3b6879", "comment": "Malware payload (RedLineStealer)", "value": "52cd9fc38ab6c9088336570d9a93d8fa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658438413, "uuid": "cd19e824-c0fd-4ed2-b1fb-82dba3dc5183", "comment": "Malware payload (RedLineStealer)", "value": "610acbedcfbd2566ad81e3e8a55e45ac39cc1ae62bafa18838af10443b250e35", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658438413, "uuid": "13bf2460-b33e-48e8-a467-e94a3bd70264", "comment": "Malware payload (RedLineStealer)", "value": "8bc90a70501c4980ec821cac7d06b824952c2502", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658438413, "uuid": "6af47fdc-6fd7-42bb-849e-dc924a05fb75", "comment": "Malware payload (RedLineStealer)", "value": "7d2e4f869e5e8c08237fb5e12394fa6fd879399036b002e5bde668fe63ca8fd7c54ab5820c067b9d5f41cb9d9f90d400", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658438413, "uuid": "08b54c2b-2553-4fb0-acaa-464b30fd4f13", "value": "T1F554E06236A0C876F4E61E3158709E752ABABC225934818B73F4FB2E2D703D12979753", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658438413, "uuid": "34049b5c-2c89-4111-af78-f736eef1d5a0", "value": "b87c62264ccceb96c52705a75b76beba", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658438413, "uuid": "75708b8f-fb45-4eac-a1a5-cc3f5bc23399", "value": "6144:+OIanujcp0ur3AaBLCmC6B2F0KdGDDA6hZvRmjtQkUbC:FIRjcp0K3NVNzEw9vYj6fC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658438413, "uuid": "4abf1761-112d-4592-86ee-ca279d53d7b6", "value": 296960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658438413, "uuid": "fe1831e0-226e-4b08-89b0-83495f6400e6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658438413, "uuid": "8d0ea2c6-c521-4c9f-bfcf-ceea6fbbd41d", "value": "52cd9fc38ab6c9088336570d9a93d8fa.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "182b5a82-08ef-11ed-93bb-42010a9c0043", "comment": "Malware payload (SilentBuilder)", "timestamp": 1658405851, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658405851, "uuid": "9cc1723c-9c34-41b9-8061-d142bf41acbe", "comment": "Malware payload (SilentBuilder)", "value": "b2a05300c2aca5f1314c23f2ec0a1579", "object_relation": "md5", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658405851, "uuid": "f91bd23d-1135-4454-be10-72b20d7e9410", "comment": "Malware payload (SilentBuilder)", "value": "62081b20b3af4e7d455b4e47754288c6bf7fabf55c5805950c289222bc14a585", "object_relation": "sha256", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658405851, "uuid": "e31b4dca-9c4c-4aae-b29d-31feaa8040aa", "comment": "Malware payload (SilentBuilder)", "value": "9d724f81ae25824f629c02e2db63116c6f9461f2", "object_relation": "sha1", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658405851, "uuid": "cbab5ed1-83e9-4c7e-9b48-151014c23ac0", "comment": "Malware payload (SilentBuilder)", "value": "6afd07d748f74189c4d51b2a8705531a71004833dde2c07c1ad9ed63aebd83e892ab1794b558ca1e5d182a88b730369c", "object_relation": "sha3-384", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658405851, "uuid": "0c928747-89df-4624-9b6b-80b9292e6487", "value": "T134C250A7BA86D8C9DA8513394C738658B767FC165FA743073659F3290FB0AE08D0361B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658405851, "uuid": "974c6aae-52cc-4ff7-b631-1364da5f7ab9", "value": "768:bsk3hbdlylKsgqopeJBWhZFGkE+cL2NdAJMr75n:bsk3hbdlylKsgqopeJBWhZFGkE+cL2NJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658405851, "uuid": "06001c1e-06c4-4430-8b23-c1d7a10a9195", "value": 26624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658405851, "uuid": "b4427453-4d6d-4ab5-8f7e-fd30f9f6ebf3", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658405851, "uuid": "d4bf65ad-c5af-4acd-9967-a8038b0b2bd9", "value": "Swift Transfer.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5db832fb-092c-11ed-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1658432167, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658432167, "uuid": "b54a2d78-f4de-4f4b-958a-24d14a3f0a4e", "comment": "Malware payload (Formbook)", "value": "1b8131ad3dbbc3329f3d071b688f773c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658432167, "uuid": "81ff022a-ea3d-4bde-8ebc-0cc1b9cd3202", "comment": "Malware payload (Formbook)", "value": "633e6fffdf7692202a7214741670a72a32c87ba3c5de44092f7580e30bae46d5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658432167, "uuid": "aac457ee-3a34-4863-87f1-a27b08a9901d", "comment": "Malware payload (Formbook)", "value": "0c1b702b3dfa8845fff77f305757f19df0d8fa0e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658432167, "uuid": "75ba38e3-6433-44f3-809c-34661a77f616", "comment": "Malware payload (Formbook)", "value": "6ee31f11449ef3ec88ebd3953df9d87e0600df31ce75a25a6ea5bff856a3fb2aa7a95f1eb729e662d72bb55c70b9fba4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658432167, "uuid": "31c1621c-a7d5-456a-b534-103d3af1e18f", "value": "T1EB945D2C7B055AB2FF1F81704C410A59BBE62F633280A9835BEB59CA874F0677F45D86", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658432167, "uuid": "57943f7f-ffa9-40f1-b5de-9b359f14409e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658432167, "uuid": "d224853c-22fc-4bd8-93d6-d2c5e00d274c", "value": "6144:IgHn68Y0ROaQ5tsXxdw2R5MjpEMzITOkzmHTIRmqJ9IU30Dwk:IY+0hQjsA2AOwERm+jKwk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658432167, "uuid": "fabebdcb-771b-49a6-9bd3-ad5637e5de7a", "value": 439296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658432167, "uuid": "552a35ae-eb30-4f8f-a6e4-ed74f164a798", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658432167, "uuid": "cc1a714f-b412-4223-9196-61adda3b8587", "value": "1b8131ad3dbbc3329f3d071b688f773c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec37a4dd-08c0-11ed-93bb-42010a9c0043", "comment": "Malware payload (AsyncRAT)", "timestamp": 1658386020, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658386020, "uuid": "850c521b-c0e6-443a-9ac6-dfb96272c0f5", "comment": "Malware payload (AsyncRAT)", "value": "fca56524754f35dbf5ecd8dd52528374", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658386020, "uuid": "65e71184-2763-482e-86dc-1d32f197a8fa", "comment": "Malware payload (AsyncRAT)", "value": "63b4600f00336a214819ed87c27c6ca6f809c5fbe12cd2a871447f72670846f5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658386020, "uuid": "7aa62048-bb22-46fc-944c-eb2bd6957b29", "comment": "Malware payload (AsyncRAT)", "value": "d0479c8d2ab4750eebfec950e52e84227ea698f5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658386020, "uuid": "45bca717-3c66-476f-9791-cf675dee1919", "comment": "Malware payload (AsyncRAT)", "value": "a755e12d9cc1e37bd148451d3a6d728b60fc24c67ddadbd47ec6e25c864bf70ac0e8ed787910f0a7da99aaa237db8dba", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658386020, "uuid": "df436e4e-1bdf-4ef6-bb38-56e4edad6e6a", "value": "T152D44BB6B652D665D4C28C7AE60ADBF6D6836D7CEC27861335D0FF3B323B121460A052", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658386020, "uuid": "33df95f4-c31b-40cb-8ce9-08d9133de624", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658386020, "uuid": "0cbdec42-5368-4276-b585-c2991214e170", "value": "6144:WFJ68bEdt1fiYcOwmZRC/HuBZpzN5/l/J7/lAA9P+mVF:WrP8tRupmZRCPuBP/ll/l39Br", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658386020, "uuid": "24f9c615-0f93-4be7-9e61-fbb0b35c2d63", "value": 612352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658386020, "uuid": "1623ff49-10a2-47df-bdb6-5a01266992e2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658386020, "uuid": "e48dfb0b-5dc9-452a-8b48-e22a31c6301b", "value": "fca56524754f35dbf5ecd8dd52528374", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe5b185e-088c-11ed-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1658363717, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658363717, "uuid": "f07b2eb2-8160-486f-a8cc-b8c2a11fefa8", "comment": "Malware payload (AgentTesla)", "value": "9eba24b64bd95f0ead1062b289783f2b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658363717, "uuid": "1117de77-70f4-4eba-b19f-140f0232ec39", "comment": "Malware payload (AgentTesla)", "value": "6480fdf229ace9411462e8eddc1830422d48985d72a8b5af7a8b486c34bcf87e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658363717, "uuid": "d2459272-3524-434b-bce3-9916bcf8e50b", "comment": "Malware payload (AgentTesla)", "value": "14c6d6f504a5f722f0f98b2bca64bd49a2af029e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658363717, "uuid": "a90d9f78-8909-478e-86af-ccde7bba5f68", "comment": "Malware payload (AgentTesla)", "value": "6e719d898461ccf8262576e7fbdfe1d3ba7bc8ec968978bf85f4dcb3ef29e78687db8b558ef0b69a63239a3da2fd2901", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658363717, "uuid": "65c73c68-222d-4a81-930f-c809f273e577", "value": "T1BA43BD269F4C8C76C04A5B300C728A8892F8EF99181993FF60757C74BA327C29D81D2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658363717, "uuid": "837f4df3-8c7f-4278-adfb-f9f4ddd43c6e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658363717, "uuid": "99715ef0-ab81-4de6-9a5c-39ed81bbdae7", "value": "1536:4rC/kGrvUUUUUJUUUUUUxzZEOASUBZS+ZwIdHOCx2PMgH:4e/kGrUUUUUJUUUUUUNISUQx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658363717, "uuid": "7d8a8952-e9a4-452a-b1c1-d7737cc392c9", "value": 56320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658363717, "uuid": "0a73bbdb-1bb0-41a6-ba65-e594379a38fe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658363717, "uuid": "e4e2fecf-b0a8-43f0-9fe8-6fc9da19ba0b", "value": "SecuriteInfo.com.W32.AIDetectNet.01.15601.20133", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94c41ba5-08d0-11ed-93bb-42010a9c0043", "comment": "Malware payload (SocGholish)", "timestamp": 1658392746, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658392746, "uuid": "8a6cefea-025c-4c57-ad25-69eaac9b4acb", "comment": "Malware payload (SocGholish)", "value": "9a52c366a67bcf1df1a55d26140b9be2", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "socgholish", "colour": "#4A4C7F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658392746, "uuid": "f4b76308-a34c-4d3b-866a-1b8c208da518", "comment": "Malware payload (SocGholish)", "value": "6495deba314ca47e45a8509cfc7ecad8cfac3ca43ca98e3153fc01961c0746c9", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "socgholish", "colour": "#4A4C7F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658392746, "uuid": "c0707dc6-ab8d-4d51-887f-992f04827815", "comment": "Malware payload (SocGholish)", "value": "600fdc0c7af40b2d74014ee91223cec7d654330d", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "socgholish", "colour": "#4A4C7F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658392746, "uuid": "31eed3bc-0790-46a5-b990-16208023018f", "comment": "Malware payload (SocGholish)", "value": "9fb33b5bbced38d64eacc048826e82b31fcb294d388a8e12b9ad98b31215123c3947a93380a06490097c8bb7865ef6f5", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "socgholish", "colour": "#4A4C7F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658392746, "uuid": "4acead15-3403-4fc7-aa5c-39ab1a50e0d0", "value": "T1F903D7DC3994F4E5167B52B6803F511FB2339920218EE500B255E6D92C74EBBA23BD3E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658392746, "uuid": "a532dc0d-a641-4855-8046-6c2365e2eabb", "value": "768:E4m7fP8PmtszZ6zds8px1Nn1uuHa8uevwUifN3auku4m7fP8PmtszZ6zds8px1Nv:kP8etszQds8px1Nn1va8uswUifN35kaD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658392746, "uuid": "fd5e573a-3843-4ed4-81fd-5563a7266a88", "value": 40126, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658392746, "uuid": "943f5e68-127d-4cde-937b-f2128e2b6b8c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658392746, "uuid": "c9bb7736-83de-4bb1-83d2-63b9860e3c21", "value": "19.7.752.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2d1dd0a-091c-11ed-93bb-42010a9c0043", "comment": "Malware payload (Loki)", "timestamp": 1658425518, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658425518, "uuid": "04b5cb2f-5b73-40a2-9a6c-795b3b981aee", "comment": "Malware payload (Loki)", "value": "130d7608f9222ec8907f392c978ea40b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658425518, "uuid": "a36c8fea-bb33-44e1-8d51-3ccc6edb58ba", "comment": "Malware payload (Loki)", "value": "651c8d9006dba22ff07cab324b79ac5658b98d3aaabb9ba26fc9b263d1fde830", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658425518, "uuid": "740b4c83-02b0-4647-abc8-316a0d02d425", "comment": "Malware payload (Loki)", "value": "6cbecca132197eb4362e63bf1bfc4488c3a73198", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658425518, "uuid": "e1b02b9a-7ac5-4390-b122-19a4761fc797", "comment": "Malware payload (Loki)", "value": "e207bb5c9557af2954c6a09f1ab91fe5af4b0cc96bcf53339eb6ccef6d5a43fefb6001442b3581e19fcc4f8c361106a1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658425518, "uuid": "fbed6deb-f63a-4bc4-8a43-5392a238bcae", "value": "T18F548D10BA90D036E4F722F44AB6926CB52D7E919B2461CF62D43AEE57346E0FC3135B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658425518, "uuid": "a8e3204e-72df-4ba6-9150-853d614fe9ce", "value": "48795acb527e88b030636c811f480ca5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658425518, "uuid": "2b3ed727-9a4f-46b5-a9ab-41de1971e64c", "value": "6144:RvZQb7B0RO3h04yowpUy5TKjZiVr+EoP57N:hOyg324yowPTuU6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658425518, "uuid": "82eb5d25-d284-4bed-8f66-cb31adca4f32", "value": 300544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658425518, "uuid": "89e1ed2f-787e-4bd2-8063-545688b110c7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658425518, "uuid": "8da13d7f-ae76-493b-a287-f60c410084b8", "value": "130d7608f9222ec8907f392c978ea40b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0be05aa3-08c1-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1658386073, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658386073, "uuid": "1d9b66ff-326d-4b7d-8d84-1bd344e804d2", "comment": "Malware payload", "value": "145186629cf226ca987625b55ed9e9c7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658386073, "uuid": "4821f28a-e0ac-48e8-997d-1515fa533659", "comment": "Malware payload", "value": "65209a1c9e0c0c1d5cfa80df4ff1ba6d1742e1b5ac8a4e32b38e49749c312cdd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658386073, "uuid": "b1c67147-7886-4eb5-aabe-5d248f25f3a9", "comment": "Malware payload", "value": "8203cfc6a8dc0ffae22167e0735a6e9169fe279d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658386073, "uuid": "6e03a012-5b5e-4670-8d75-f57efe686679", "comment": "Malware payload", "value": "47522a95b147886970baf35dc4f1c727b50f3c9f97207d9f266536c7d60176c1203f592313aace8e487e2d40b107dc9f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658386073, "uuid": "b88c81f7-4a7a-468b-8468-4e720533b390", "value": "T100D439262F16D749C2C0F6F8AD226B84C5A1FC583DEACD31A2F1B62D49797C4506D82F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658386073, "uuid": "e750402c-79b9-474e-a301-34b6d2787b71", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658386073, "uuid": "47cd03ee-a783-4fcc-af57-13980062081a", "value": "12288:6Lo/Jm2IhImMeg+gk4GEcMRwAciycSHKW3:6LwmZMz3GuRwAcK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658386073, "uuid": "32da84af-6271-4ac1-8010-994021bc6dce", "value": 646144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658386073, "uuid": "3a1ce073-3e9f-4414-a518-0e5d9496c9e1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658386073, "uuid": "9c743862-3bb5-4784-91c0-0f287282340a", "value": "145186629cf226ca987625b55ed9e9c7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e459a98-08b8-11ed-93bb-42010a9c0043", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1658382454, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658382454, "uuid": "eab9c5ca-504f-4c71-859c-1fc1973c8aca", "comment": "Malware payload (SnakeKeylogger)", "value": "5088041427c8889f0b769b1f0d6b802a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658382454, "uuid": "4c3a18b9-8bae-4d73-a7ab-9eec3fd13776", "comment": "Malware payload (SnakeKeylogger)", "value": "658cb26b4f26e4ecf21c85c6138ceb52c614ca4092a69c365d324ff0b4b0d7c0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658382454, "uuid": "a2e887ba-6846-4bdf-a109-51d1a71622f9", "comment": "Malware payload (SnakeKeylogger)", "value": "4c881a72378d5bfdaac8333e983feaf6ab353fa6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658382454, "uuid": "7ed40d8b-455a-4e65-969c-479e657e318a", "comment": "Malware payload (SnakeKeylogger)", "value": "b015259c486535b629bace8f6c11177b7031b6c60bc1f03743d7d7fd1c9eb68a59df3d7607b3416abd59692fb53fe248", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658382454, "uuid": "7d81daf5-1585-4d86-a912-5fcbba3f6846", "value": "T13CF40100377C5FA2C5BD87FE24A4548113F6665F622EE3894EE2B4DF2966F410A51F0B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658382454, "uuid": "daf9f1d3-81e9-444a-aee6-20da78ca4d85", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658382454, "uuid": "ea3a63b0-e319-4235-a245-882012364f2b", "value": "12288:wW7hEi/NzB0Wym2VcOeXQfpwSs+qzeOjWL10lMzRry8ujKx3VCPH7:/7ii/Nl082Vc3XPuOiL10lCNy853ET", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658382454, "uuid": "9d1d5f37-a208-42c8-a7cc-6d0788045ac0", "value": 786432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658382454, "uuid": "404633d9-8c4c-4674-b9bb-6e2a136c06bc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658382454, "uuid": "a14cd40b-83a2-456d-befd-4cb3df7e9307", "value": "RFQ REF R2100131410.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "850ca5c8-08be-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1658384988, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658384988, "uuid": "aa3c682a-5171-4ed2-b526-2e58e03032ab", "comment": "Malware payload", "value": "fd9bf556f09a907e941f17d16248346a", "object_relation": "md5", "Tag": [ { "name": "#ChromeLoader", "colour": "#B05801", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658384988, "uuid": "04ee33cb-71f7-45af-b791-1b6aef09a131", "comment": "Malware payload", "value": "65c0b0220a50672bc61e3a3f94a0667ff4c15e33cf81d20f5dc95c8c8caaf31e", "object_relation": "sha256", "Tag": [ { "name": "#ChromeLoader", "colour": "#B05801", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658384988, "uuid": "69d5f9c5-2e60-4b7b-950b-8e3dcbf74d37", "comment": "Malware payload", "value": "a0c3c59269b3ea832eba8e6429fd9ea4a1de77c0", "object_relation": "sha1", "Tag": [ { "name": "#ChromeLoader", "colour": "#B05801", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658384988, "uuid": "3bb60d78-24ed-4da4-81a1-3ea1d0875fac", "comment": "Malware payload", "value": "fd2b7fe849d167134e603c330b805c8024ff62881feb98787ec1ca3ef0a8746314cf612811ae3feddd1f3746ce062d24", "object_relation": "sha3-384", "Tag": [ { "name": "#ChromeLoader", "colour": "#B05801", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658384988, "uuid": "f7a2bd46-c0b4-48ba-b3a6-f01c548cad2d", "value": "T176C28545A4C320F551BEC2B91D6F35825838A810DB04CC9F6521D3AB9CAA2CAF5F77E3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658384988, "uuid": "29993fdb-ac52-4d56-9db0-8d88b858f123", "value": "384:+ZTYVS2O2UP2hDf5xrsAqUVAGm+YndHeRrrQvycle+bMeW6jfbrDDM/2y:02wATVTrlUbMeWKzrDDI2y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658384988, "uuid": "411c47cd-c0cb-49ec-88ea-919d25ca6f93", "value": 27171, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658384988, "uuid": "f544ad31-f470-45e7-9c6c-71501da1b555", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658384988, "uuid": "c0edefa9-76a7-4db5-88bd-03fabe0b3f03", "value": "background.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fce79c02-0928-11ed-93bb-42010a9c0043", "comment": "Malware payload (STRRAT)", "timestamp": 1658430716, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658430716, "uuid": "498dc0f3-6501-4f0b-a877-25d419d38c5c", "comment": "Malware payload (STRRAT)", "value": "ff38ca34a37d3c3716663b9e777efbf8", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658430716, "uuid": "c4baca97-33c9-495f-bfa9-798fcb1442c2", "comment": "Malware payload (STRRAT)", "value": "66fe5674de0f9d401c73920c9ec93d7a51fc52591ccdfa976c2ac7c96204375a", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658430716, "uuid": "f78d9aa2-3e4d-4aa7-8945-543877e32b17", "comment": "Malware payload (STRRAT)", "value": "ba03e4b46b4a67d4ae7be1ea21d9fa5aa6da7ddd", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658430716, "uuid": "e0485e8c-6864-4c74-b214-a3ba18c983c4", "comment": "Malware payload (STRRAT)", "value": "ec42f07a0ca19bd72b891689bff3b86b9d627e0f551a5dd3259eee8a50f8457f6485928c2e4f493f401c489375eba44f", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658430716, "uuid": "7adc9f21-c666-4eac-9276-700878673a4e", "value": "T17B147C56E5866E5E8F38B205B3A6161241B1D6CA362413BAA5BF6F4FBB3DC0F153310C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658430716, "uuid": "049ffb62-103b-452d-9425-23e43956e04f", "value": "3072:mBZdV0xRoY9RLhZnN3PVd4JHT2/DQvcyfKFY/m3Eu6TZB0atT:iPyBPHnNfVdiqsvfUYLBThx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658430716, "uuid": "93d2664c-d89b-481b-bb0c-7a13a296d678", "value": 204471, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658430716, "uuid": "40fec3ef-16ba-4306-afc9-7345b0a29fe4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658430716, "uuid": "635a3ede-8d5e-4b59-84c4-8a934a1313d3", "value": "Tax Returns Of R38,765.50.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "334a8a85-08b1-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1658379268, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658379268, "uuid": "c8e81a49-5c73-436b-8831-e42bbdfee1bc", "comment": "Malware payload", "value": "9b0b587a53a408bcfc9369e1119ee451", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658379268, "uuid": "3b030fdd-ecdc-434d-9fad-980d91d4eb88", "comment": "Malware payload", "value": "6986498bb03c9044c5607bde71b3c498855212c38272c62dc359418df0bc1e53", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658379268, "uuid": "de7b1330-9ffb-477c-94a5-a7fafa686604", "comment": "Malware payload", "value": "ef432e3b0d7df82d1c729dfc2937b9ee59c0f49c", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658379268, "uuid": "30df6b94-1aa4-46e5-b442-a78cdfb4abc8", "comment": "Malware payload", "value": "7422281e73efd2e579a858435458c0e6a2ede866542e8c19443d816bfcc54f7e6f40d7397ea5a1b4c960c65484401e25", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658379268, "uuid": "3fc80c6e-ec06-4a14-bf2b-b4a71c3a1d5a", "value": "T117123A6DA3884FD5CBDCA2F51606BF5910ADBB0867C6DADB68BC33B24F0587D4607844", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658379268, "uuid": "46b0959b-e6f7-432a-a9eb-c6001d84686d", "value": "192:ipn29DBtIfeJXMIRFXiKgYxTulmW/mkknZC7l/OkKy8oZj5ElZ:iyEeJ8ITiKgb5/mnZYOkKZ2NElZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658379268, "uuid": "edee650e-b50a-40c2-bd63-15a7b96b31c0", "value": 9637, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658379268, "uuid": "4527ce30-aa94-4821-8669-fcc732e1bed5", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658379268, "uuid": "452cb4d5-394b-4faf-b6bf-213bd34633cf", "value": "Rechnung+CAT.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8e9b568-08f4-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1658408375, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658408375, "uuid": "e6f27746-d2b5-4c66-8e1a-bad03bf4557f", "comment": "Malware payload (Mirai)", "value": "82260d3bb4f8791faf7748f9b82f58ed", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658408375, "uuid": "a352b61c-20d5-4a44-9aaf-bd1ca48d0446", "comment": "Malware payload (Mirai)", "value": "69da2ec42f4fda64a7f0ccb6952de2ed2d842b4a8497a9999470ef41f7ef6a99", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658408375, "uuid": "ea51ace3-06ea-43ca-9741-f653e351185b", "comment": "Malware payload (Mirai)", "value": "dd161455147e0c887eea691ebe6883aea20f1908", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658408375, "uuid": "27bca97f-196e-4d3c-a49f-2999b25d866a", "comment": "Malware payload (Mirai)", "value": "a30a86ca0e0f447c98761319fc32033aaf0df57c73bb551a5588ef5a634f8e8968b652ea03473594327b4496f57dd1f0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658408375, "uuid": "099f93dd-c8c9-492f-9e4b-968bfc7a660e", "value": "T1BE6339256E752E17C0D4B4BA62F78350B2FA660E29E4C61E7C320F8DFF60684A6175F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658408375, "uuid": "faa675ef-b434-4ead-b2a4-ce94dab06fd9", "value": "1536:VFKexuAZlkm14Isnf5rM/snOkGgbDuaBTZ6eWC:7D/tknOsblseWC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658408375, "uuid": "67433383-0903-496d-a8ff-a4c19ae85786", "value": 66900, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658408375, "uuid": "388a8c9f-c493-4c95-abac-552227a78299", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658408375, "uuid": "74202ac1-4c87-4fae-905a-20c5b03e81fb", "value": "82260d3bb4f8791faf7748f9b82f58ed", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c07cf02-091c-11ed-93bb-42010a9c0043", "comment": "Malware payload (RedLineStealer)", "timestamp": 1658425212, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658425212, "uuid": "d5bb21d1-e365-4e79-b1d2-4a2509d7650e", "comment": "Malware payload (RedLineStealer)", "value": "0e0716fafe56bccc7a032dd28748b42e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658425212, "uuid": "e972db51-ddd6-42e1-b37d-ada995f8ab12", "comment": "Malware payload (RedLineStealer)", "value": "6cbb42f506242b794a0d432be88ed8cf2442e6b0fc2693abc9372fd9ff62cdfb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658425212, "uuid": "3fc24668-5471-4916-894f-1340aa8d31b0", "comment": "Malware payload (RedLineStealer)", "value": "f74ff49f3a052066cf0c3e51a7af7f67479a3d96", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658425212, "uuid": "78f4fa2f-79bc-47dd-b052-64be95d3a222", "comment": "Malware payload (RedLineStealer)", "value": "45b7caf602c351278e53f85e2b3594157a9c625bee9500c7f751f02594414e411251338e85fc032cc71626012c872dd4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658425212, "uuid": "1ad219ef-343c-474a-bc58-efc44e807d21", "value": "T14054F1917AA0C831D0E365305872BBB0A67AFC239677D18B73A4376E6F302D16678357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658425212, "uuid": "af4c1f8c-2b16-4db7-91ea-23d737d29278", "value": "b5d67d85726d53f797f7d82017938c03", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658425212, "uuid": "072370da-be5d-4965-89ed-0b553126c975", "value": "6144:dQCzYphzy1QUs31mLVblK+TcKXBleGVPU67s2Rnk8FT:6dpc1QFmLlcvKXBl3Pz79kW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658425212, "uuid": "d08d8b7f-618e-4cec-b9e1-bdf5d09487b6", "value": 295936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658425212, "uuid": "e0de891f-849a-4e6a-a957-ac0cf02822aa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658425212, "uuid": "8a82c288-d0d9-4332-8719-1b19ae8d8ec5", "value": "0e0716fafe56bccc7a032dd28748b42e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d749b35b-089f-11ed-93bb-42010a9c0043", "comment": "Malware payload (RedLineStealer)", "timestamp": 1658371812, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658371812, "uuid": "731403a5-acbc-4492-a97e-78515aa88106", "comment": "Malware payload (RedLineStealer)", "value": "1992feb0a3a6565ff611d75824961ff5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658371812, "uuid": "f43050b7-d9a6-4259-86c8-3c73487ee541", "comment": "Malware payload (RedLineStealer)", "value": "6dd4105c5802741891db629a0ed2d8941dc0ea61411fdd2476709447228cd8aa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658371812, "uuid": "166b601e-1a69-4d08-9a37-fc2086c1f643", "comment": "Malware payload (RedLineStealer)", "value": "34bb53d51aec25bc4755edcc2f6ccfd6e5a39cab", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658371812, "uuid": "4168ee50-0fc3-4ca8-914a-9a80930acb8b", "comment": "Malware payload (RedLineStealer)", "value": "4772bff44a180eadc814d297362fb14ba4fc1c5a6c544e9a62e9c6b9827311ee5704806c7459f46d8806cfce107a6b82", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658371812, "uuid": "3caa8760-8533-4a07-bd81-2f0ea5785be7", "value": "T1DF84BF10BA90D435F4B712F85A768768B93E7EA16B2054CF32D52AEE47346E1EC3131B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658371812, "uuid": "576f43aa-ef53-4b6e-98a2-c45d5b316e03", "value": "976d12f8d334d9267ea345a5cd4e901a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658371812, "uuid": "406a4053-1dc1-4cbe-b188-e71fa1f60985", "value": "12288:P01PP9l2LoZH4ZorXxGYpMlZhV9mG/ay:yPaOBXIYsZ9mG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658371812, "uuid": "c3a01773-1358-4ffc-95f8-ba5561699a73", "value": 404992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658371812, "uuid": "b7614f73-e11d-4498-80f1-2fb839d837db", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658371812, "uuid": "6e3ae6f1-a994-4eb9-8569-57b072c5aebf", "value": "1992feb0a3a6565ff611d75824961ff5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "794786e9-08df-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1658399142, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658399142, "uuid": "ce025d01-d9d1-4d14-8ece-68349045b3cc", "comment": "Malware payload (Mirai)", "value": "86d1cef5328cd6d654a811baf4d58a65", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658399142, "uuid": "7e176c2b-26e4-4681-a8d6-2041bb9dd8af", "comment": "Malware payload (Mirai)", "value": "6f3f8949c1ac2716376f7c8c5037af723e5c9cf6a9ec484afc4f209db4d4ded3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658399142, "uuid": "563cdcab-b609-454b-8d30-70fbf183340c", "comment": "Malware payload (Mirai)", "value": "d78cab65b5689917392eaeb073384ce09be3a091", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658399142, "uuid": "3d69085a-395d-4cc3-bf46-637e00fc35f0", "comment": "Malware payload (Mirai)", "value": "5aa25856ada0292a0c29faffd8e49d7d11d0f1cb242e24c776a6d098511c35c8080d323bb7002be063dc8b5b0eaae899", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658399142, "uuid": "4bed2133-11c8-435f-bf4f-4b9d9c39dec1", "value": "T14B33A515FB510FB7DC9BCC370AA92B0129CD554A22F57B367970C928B94B24F1AE3CA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658399142, "uuid": "a5c62067-9592-420f-b3a7-67cecbdcdc39", "value": "768:WASRl++tTv1KMecloe2/eopLa99ZYpEJqXij+IM+wzm:JSRl+WHo//NLaHZYpc+jz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658399142, "uuid": "e2bbdf1f-8099-4f38-a47c-8556d16bf04d", "value": 51420, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658399142, "uuid": "531d1d72-9ec1-4f4c-bf2a-7c84e61d8fdb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658399142, "uuid": "5106969f-9f59-4053-9936-84472807cf03", "value": "86d1cef5328cd6d654a811baf4d58a65", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0bca85b7-08c9-11ed-93bb-42010a9c0043", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1658389509, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658389509, "uuid": "2ac7ebfa-11c9-43cf-a799-5234cc9c8e2f", "comment": "Malware payload (SnakeKeylogger)", "value": "ab560c5f6e7a8c0f9d1f2ab81ca07b68", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658389509, "uuid": "7f0f1f71-3202-434f-8faa-a6509aaa9602", "comment": "Malware payload (SnakeKeylogger)", "value": "6f50e2e2e8aa71712037f52d18526729f0aff68865f075b7d620db1ff35fb9b9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658389509, "uuid": "b50ff429-1de8-499a-89e9-03727d84e522", "comment": "Malware payload (SnakeKeylogger)", "value": "5f03ab29d9c59e210c00215997d45beb874b4fab", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658389509, "uuid": "0db852a7-9679-48bc-8e56-71a079ac7163", "comment": "Malware payload (SnakeKeylogger)", "value": "b0a36036b43b86ef171259bfb47dbe0b0f28a331ff6cb7685f62136dba4c78fdf695fbd96e20a1f2abd46e43ff59f2aa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658389509, "uuid": "0f96fdd4-aba4-4e06-a421-d0de973e535b", "value": "T1A205123720E9BB11CA3817F200A362891AF3B10E3575F51E28EFA4AE85E47D45B517E7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658389509, "uuid": "0585ea8f-bee1-4480-9d2e-e8f4d648bbcc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658389509, "uuid": "7782d449-549a-4627-9923-44d233f89246", "value": "12288:VsEu40j0EluPyChbBQmQpDip9Vh+zW9nM+JWSTgeRiHm0FWx8c31h:307lu6juVh7M+USTxiMxz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658389509, "uuid": "43d84bd4-2136-4619-800d-b6a18a5ca0df", "value": 796672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658389509, "uuid": "09d11f62-986e-4c1b-adcc-55180bb04af3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658389509, "uuid": "4f33798f-1b6e-41be-b827-8ca968483522", "value": "ab560c5f6e7a8c0f9d1f2ab81ca07b68.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2962bbe-088b-11ed-93bb-42010a9c0043", "comment": "Malware payload (RedLineStealer)", "timestamp": 1658363133, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658363133, "uuid": "65234fe7-14c2-4d7a-8a41-0a1299b0e566", "comment": "Malware payload (RedLineStealer)", "value": "16209c7910fc71f78da24fe620b81af5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658363133, "uuid": "a29eb2cc-751f-4088-897f-f474fdfa5271", "comment": "Malware payload (RedLineStealer)", "value": "6f7fe0fe7324278f35596f11fab7dc1336e73aa7830bb880060d2b94a6cc2823", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658363133, "uuid": "fdc890a0-e73b-450f-9c05-b8ad2c78f0f4", "comment": "Malware payload (RedLineStealer)", "value": "55bcb4b8bc64163a647acfb7ec71528cb2e8b93d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658363133, "uuid": "f11d2073-1500-4e5a-9888-6f0b9ccfb433", "comment": "Malware payload (RedLineStealer)", "value": "e7f5ae37effbe27907a0c16c3eed0f7f0190def730be3615b87e1f3c7b183b714be79ee82c2ae8f891f4ebb644923a11", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658363133, "uuid": "eb8827bc-2ad9-45e5-809b-fc69f80af9b5", "value": "T12954F11132A0D873E0A3653054B58B725EB9B4335D7CD68BB7A41B3E8F703E05AB5366", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658363133, "uuid": "cd42d0b5-6ca8-4bb8-850c-31eb67e96d0e", "value": "085db6b068e0ab532921326907b886ab", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658363133, "uuid": "b6dc8ecb-8049-469c-b83a-1022cc233a15", "value": "6144:rMN+NuqzxtwkVbjQqN2n/kNj//lOwzAMfqJZGErL+dVU:r6GahqN++jswQJowL+8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658363133, "uuid": "8a980621-56fc-4eee-aa44-5c48b319ed70", "value": 296448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658363133, "uuid": "c94a37c0-d825-48a2-8283-72c298ad4947", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658363133, "uuid": "78865265-cdc9-4128-bbfb-6d018903cb45", "value": "16209c7910fc71f78da24fe620b81af5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84fbf5d5-08f0-11ed-93bb-42010a9c0043", "comment": "Malware payload (CobaltStrike)", "timestamp": 1658406463, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658406463, "uuid": "d4e5bffe-7680-465d-a92b-0394dc1bda52", "comment": "Malware payload (CobaltStrike)", "value": "1ecdf5858066a47e0e67634409edfc38", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658406463, "uuid": "cc34078b-d84b-4870-a4b7-69be1a952bd3", "comment": "Malware payload (CobaltStrike)", "value": "703c9237856738e87683ba32d983cbf8e5db2e284553190ee768d0ebb0a0580a", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658406463, "uuid": "7b7577ba-b03d-4a23-a131-97b228ef20db", "comment": "Malware payload (CobaltStrike)", "value": "543c6835cda6a76f8ad5e30e67ce57a2bca88d81", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658406463, "uuid": "35637fb7-d7e1-4fdc-837f-448984d433c6", "comment": "Malware payload (CobaltStrike)", "value": "56256695ff95b9be011db9b53fbed32e6f8611410164d0f769a9973e1db4d58bccb17409d96f93b55b1e543e1629bb9a", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658406463, "uuid": "7ca3c82a-b2e5-4fee-b3a3-cab1960fb981", "value": "T15AF42869BA0AA625DDFDF938AC830EF0225D98C50242CF1B674F2FA1BF75D5467A3101", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658406463, "uuid": "ced6000f-6fe1-46ca-bf1b-3179cec1d042", "value": "e808adf40f45e15f02c3a79cc0b168eb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658406463, "uuid": "17acdbbe-dc59-4e3b-92d6-41ac95c6d78f", "value": "12288:Dkrd72krd72krd72krd72krd7+mdLnKU4LUQn60k11P74:FjDfndk11P74", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658406463, "uuid": "e4936575-5da0-4795-8f50-9b1185e57dbb", "value": 725504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658406463, "uuid": "fbc198ee-7346-4acb-a273-54747fd3af1f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658406463, "uuid": "db5ae964-5216-42fc-b7f0-f7a75fc06fa1", "value": "1ecdf5858066a47e0e67634409edfc38", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0057c101-08f5-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1658408388, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658408388, "uuid": "4e0ff1d3-8715-4bf6-8aad-d836a6ba0bac", "comment": "Malware payload (Mirai)", "value": "3e42b510f7335353d2823b6da4b400b8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658408388, "uuid": "2fa44262-f26a-4e3b-8e31-dfcc5916b089", "comment": "Malware payload (Mirai)", "value": "705022072d1ec4bea656677fb70499ff6d7c2a94c2fe96780dbbf3da9dc66650", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658408388, "uuid": "68887ec5-d33b-484f-9e2c-e504113d7489", "comment": "Malware payload (Mirai)", "value": "a7a15e6c8bfc7d9876a529f6e8fff1d48403f964", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658408388, "uuid": "d15e8d68-469f-487d-aa76-ed3cf2d17e62", "comment": "Malware payload (Mirai)", "value": "409996bb31fbd52d47b75fb321820eae0e5e7343fce2d61b99d4c93e3044ea3d1f63090acaa97f4ef40abdfe79b52697", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658408388, "uuid": "1e271a8c-d504-42a3-ac49-03506bec7cfd", "value": "T1CAC2E165E1F846A8F0EB45F58C59E7C1B7C847CB3389C5F23ADD8D245C6A9AA7000C96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658408388, "uuid": "0049940e-d1c7-4df4-bc12-cf6631e253c8", "value": "768:BRGqDAlOtvEi8NFF1GwIsomYTzLqboAH94uVcqgw0RNWX+:clOtvE961RTzLKH94u+qgw0bWX+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658408388, "uuid": "8d2645d9-dabb-4492-84a7-e26316ccfcf8", "value": 25864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658408388, "uuid": "95fe77cd-7cdf-4e44-a1db-04f595a89389", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658408388, "uuid": "607e49aa-4c8c-4558-8ae9-e11f921a7efe", "value": "3e42b510f7335353d2823b6da4b400b8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "827b4cdd-08f1-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1658406888, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658406888, "uuid": "0c7bde24-fda3-4f48-9e00-e515cadc8dee", "comment": "Malware payload (Mirai)", "value": "4069bce5d49217da2351ff1bc796fd1c", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658406888, "uuid": "19d22416-9eb0-454f-b5fc-658c17609f60", "comment": "Malware payload (Mirai)", "value": "711241388e5661fb348bab301b61484d308c2521c341af28e8331ffc0ceee8d2", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658406888, "uuid": "bdc4c30e-4dd4-4215-9d84-d341dbfeb267", "comment": "Malware payload (Mirai)", "value": "091a1c6b885ae9d1c445837f3dbebf5b945e559b", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658406888, "uuid": "4a969c03-d06e-4d36-83c8-135f9d1abeb5", "comment": "Malware payload (Mirai)", "value": "368645c648ed3b15f520674d4e271d53e597ea9748a700b575750c49e50f9f1eac0d654b783b9e1bd6dec6f639ea2512", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658406888, "uuid": "f20d9ba8-bc9e-4a2d-8888-1901db0f8d76", "value": "T18653F162E447F8A6DEE7083ACB680BD86FC527AD83D2B4CB54614960DF0ED40DEAD053", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658406888, "uuid": "d63a5e35-9173-487b-b14e-8cab926d7c1e", "value": "1536:+olghLaok6zk9AX88XRTv0llX4HQLFDM62:+McLlzkeUoHQLpMH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658406888, "uuid": "f4972225-db92-4e86-845b-6f30346990a9", "value": 61152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658406888, "uuid": "1dc16845-dc5c-42f6-95ab-7c9afbee3144", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658406888, "uuid": "f8f2ac42-9015-4c46-a393-eda78c083287", "value": "home.arm7-20220721-1234", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "237f1eb3-092c-11ed-93bb-42010a9c0043", "comment": "Malware payload (RedLineStealer)", "timestamp": 1658432069, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658432069, "uuid": "04b2c053-debc-4498-b95e-6e197bd06c7e", "comment": "Malware payload (RedLineStealer)", "value": "588429dca6f4c5d4e834296158df6103", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658432069, "uuid": "f93de66b-2226-46fe-babd-1888822c3c4b", "comment": "Malware payload (RedLineStealer)", "value": "7119710c216d63bb5fa9368face9e894556563884fe032a7b532ef7120290de5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658432069, "uuid": "a380fd5e-fef0-4af3-837a-0b74900adeb8", "comment": "Malware payload (RedLineStealer)", "value": "87cbcac878c92eb7c8e405327051bb51422e44db", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658432069, "uuid": "dd45840c-6943-4fed-ad64-f8ded18b8476", "comment": "Malware payload (RedLineStealer)", "value": "123f1177c6243558fc23670e76da8bfb957307f63f21ad488a130edb380992148b4d7412b2901e30400e430067ae310b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658432069, "uuid": "5d8512b2-6c09-44c7-92b8-5c1306b55d29", "value": "T1FA84CF10B690D435F4B712F49AB9926CB93E3EE0AB2454CF22D42AEE57356E4EC31317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658432069, "uuid": "2e28d452-d47a-4e73-84f5-c6a4c0627e26", "value": "1b97f05cb610b2d3adc3f233ecd03f7e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658432069, "uuid": "9e66280e-b32c-4f7a-9bed-9b1aaa714029", "value": "12288:BqdPqDkG1VTdNvFZOZgPsd8f9vr6RPF/4:MQDdnTOZgEAvIPp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658432069, "uuid": "1b8bd0be-0a08-49b4-aa87-427392eb6394", "value": 405504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658432069, "uuid": "5624bd23-7b70-4031-a160-3a4b154e9814", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658432069, "uuid": "378337ff-bb60-4afa-8e31-3b078a551433", "value": "588429dca6f4c5d4e834296158df6103", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b9ec2dc-08cb-11ed-93bb-42010a9c0043", "comment": "Malware payload (Vjw0rm)", "timestamp": 1658390502, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658390502, "uuid": "e8804ce7-ba3f-452e-83ae-4b0f24e1bab2", "comment": "Malware payload (Vjw0rm)", "value": "45cf6667b1e1fe103886ed50cb2f3224", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658390502, "uuid": "d90ca866-3b31-4aaf-8a78-4ad8885b1926", "comment": "Malware payload (Vjw0rm)", "value": "714b4b7f165892827d6ae43843a59b200441b3cabd48abe9a578039978a92d95", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658390502, "uuid": "bfdd4945-e722-4868-b628-c22ffc3da077", "comment": "Malware payload (Vjw0rm)", "value": "66724e3564c4f315750afce15e72e4068fb04857", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658390502, "uuid": "7819b056-dd44-4f0a-8a86-036bc9e6bd12", "comment": "Malware payload (Vjw0rm)", "value": "d5663b42d6858910dae4c5592195e4276940348508510d017d5324580ea94b011c47ddc9734213b07dc45d87b51501e7", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658390502, "uuid": "28c6e4bb-0861-4203-a592-0271c157e8e9", "value": "T13E323AC46C15BB1A4B8259D2B7CE5C809FFD821A5221CA9F74B2B5C99124488FE3C7BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658390502, "uuid": "ca569d73-c56a-4d01-bbaa-6188cf21baf0", "value": "192:OZd7nG796qJy/o6UmK6LsSYPKlsXJX3yjSzo8gcDaypG14f9qLvq52NvxJo:U9lopmKosTX0+9gcDdVaC5co", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658390502, "uuid": "8ca482b5-8633-4d04-9d8d-fba091d6bdb3", "value": 10961, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658390502, "uuid": "f1762944-1c94-4bbd-ac2d-a83ba0d928df", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658390502, "uuid": "ad317646-c715-4593-97c5-87a87d1209dc", "value": "Turnair.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a1dac5e-08e9-11ed-93bb-42010a9c0043", "comment": "Malware payload (QuasarRAT)", "timestamp": 1658403304, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658403304, "uuid": "f895d23f-1296-46af-8421-9638e2654b77", "comment": "Malware payload (QuasarRAT)", "value": "41eb4ab1efca9fb7f1c9a56eaf72b3c1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658403304, "uuid": "5fd92d68-0103-4004-bf7b-866f33e09b24", "comment": "Malware payload (QuasarRAT)", "value": "724ff8546f194ffa5aadb446a00a6476aceedda46114bb9ad8f8ad9f32e27493", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658403304, "uuid": "e0a30ac8-e3a7-4035-9ebf-8af611f88bf6", "comment": "Malware payload (QuasarRAT)", "value": "e645bcfa5bbd61818ca6d9cc651bfd256c857b38", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658403304, "uuid": "7ed44612-6f18-4aa4-b72d-43d1d53af918", "comment": "Malware payload (QuasarRAT)", "value": "31b6e6fde53e3df6ded55e91c10b2ae55dbde85d192502636e0c3d6442c77faf7216a280a8d97660d4efdccb7b0f0f60", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658403304, "uuid": "3e44a399-9a95-43c3-b7b8-42e7fcecae97", "value": "T1CD9633635368EAB7E1FD2236E0B5030A0BB1A159B701E3DBBA6C11785C7A3C19D517B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658403304, "uuid": "c1ab8f1f-d4ca-401c-90d1-bae8994f48af", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658403304, "uuid": "a97405ab-4c2f-40f8-a7b4-dda11e01e573", "value": "196608:DK67iZRRrTpioJekPFbHAlnNMHslwFUrnTWpB8xScxP9yoEvHCWL:+6KgkPFpHs8UfA49uvHP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658403304, "uuid": "6e923b41-63e7-4086-8cf8-7a65fd109e11", "value": 9148416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658403304, "uuid": "d5bb2a4e-dc5c-4b0b-95ff-fed6b5cfc7d1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658403304, "uuid": "b10e833a-01a1-4cac-b870-c8130266f22e", "value": "41eb4ab1efca9fb7f1c9a56eaf72b3c1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cebc6fe4-090f-11ed-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1658419901, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658419901, "uuid": "298648c8-a8f8-4ec4-8205-6ea34e88cb97", "comment": "Malware payload (AgentTesla)", "value": "190ed6df01d9b722cd3bf1ef94461aa8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658419901, "uuid": "075ef2b8-cb7d-4559-bcd4-5a0856766d49", "comment": "Malware payload (AgentTesla)", "value": "726049b62b7aa78b24e6bbe3b589446acc258bd1795fef985910bce206555695", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658419901, "uuid": "742cf9d0-d23f-47ed-91d7-9b51e62083eb", "comment": "Malware payload (AgentTesla)", "value": "6247d690f11a792a253771213345f92383d6c6c6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658419901, "uuid": "58d5fc02-4627-4d2f-8778-f118dd9ebd45", "comment": "Malware payload (AgentTesla)", "value": "9c4c7b3bf678e1f87aef87944c12ab17f7d04332be0dec50bfa4e7857ad828a01bb574c64887328ed6a3dd9c62f355bf", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658419901, "uuid": "cf5f6aeb-ba9a-4d4a-893f-7c76a7292c45", "value": "T1B0F4CF14B767CD03C67C13B6C0C3554483B5C505A16EEB8B6ECA22D61F82BE79ACA787", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658419901, "uuid": "b259f47c-9030-4f69-bf58-c22ac73511bd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658419901, "uuid": "bef9b663-852d-4556-89dc-fd836250cec4", "value": "12288:2s8GFHQypKkv/Y231huGqdfbgVxvE7WhqhjxECFe6y1Ug0jvhzS:2sXxvwyuZQxM7k+7s0pDhzS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658419901, "uuid": "da8fbe56-54e7-4cdb-a899-5ff3166c6e4a", "value": 763392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658419901, "uuid": "4783c7f4-7d70-40cf-a165-5b5770124937", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658419901, "uuid": "71e9a100-8e1b-4ecc-b603-8cad8c067ee0", "value": "190ed6df01d9b722cd3bf1ef94461aa8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29844af7-08fe-11ed-93bb-42010a9c0043", "comment": "Malware payload (Loki)", "timestamp": 1658412322, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658412322, "uuid": "93939009-588d-4c28-b228-5343f99571a1", "comment": "Malware payload (Loki)", "value": "795756c50625851c0ba5a57ac68567ff", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658412322, "uuid": "2c081491-a3b1-4f82-bd74-ff6f2304ac77", "comment": "Malware payload (Loki)", "value": "727f97eaa8e6577c2d17c8d9066d23a2d0147791d3af7ed0e714fff32d35d89a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658412322, "uuid": "f8759477-f3f2-4803-8e72-894d7a89ba58", "comment": "Malware payload (Loki)", "value": "ac9a3c2fcb70cea810c84898b7e89c0e0e269b6e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658412322, "uuid": "3e67abc8-a8e5-4e21-8a07-8cddef3f29b8", "comment": "Malware payload (Loki)", "value": "ed83f73b400830884ee8cc0365605e09bee480994c18030460842b9cfdf23f588362e396ef21f7dc458e5213ac4a9434", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658412322, "uuid": "7dcf2900-859a-4d4f-b1aa-3bdf3ee51718", "value": "T19ED4AF147B37CD13C27817BBD1C2204483F19906E16AD78B6ECA23D61A067EB9ED9787", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658412322, "uuid": "451a579a-fed5-4166-b652-85305ee32007", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658412322, "uuid": "b9ae5770-3c5b-454f-bb60-a03615c89bd0", "value": "6144:b6y9OWx6KqBP49HN2qvW99IjPm31hjR6JGyMvZZ1grtuUkpIWyBOmAvLOuuPKV5t:OOOvCzvW9z31huUVyB2yEfrxoyN3h19", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658412322, "uuid": "af308a3a-f8a8-4438-9bf7-9ec3ab9d82d8", "value": 648704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658412322, "uuid": "fcebbfa6-4b8b-474c-aeb2-8f54449b1cfb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658412322, "uuid": "231fd2f2-407d-4886-aaf0-6bfb15241dad", "value": "DRAFTSHIPPINGDOCUMENTSCOSCOSHIPPINGAQUARIUSFI.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21fd0804-08cf-11ed-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1658392123, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658392123, "uuid": "62169ae8-981b-4cd6-b176-e473b144fbfe", "comment": "Malware payload (Formbook)", "value": "2424734321f03e8048202f10ba707c29", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658392123, "uuid": "e2eaad69-ec49-4c16-b5a8-f0bffb19d710", "comment": "Malware payload (Formbook)", "value": "72fd8d816c54cacc80a7364d61fccfb6f4c2b9a88ed0cb9296e038b615731cfb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658392123, "uuid": "18224ef4-bf7a-4b51-9d8a-415013a69616", "comment": "Malware payload (Formbook)", "value": "e085ae7d3b35f036ebf49076869203a29d9db3c0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658392123, "uuid": "e72212af-2da7-48d8-9b88-fcae413d314d", "comment": "Malware payload (Formbook)", "value": "ce022d2bf5d7b027b57075e5319982799650cd09289da49d9c491a82eef5c96f860ea2bb137eb9a035bd9254107020f9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658392123, "uuid": "8c090d50-2a2a-4f02-88b9-fecf968dc964", "value": "T183C4E094F6C4C17EE4FBCB7D0BE464717BE1E5129609E07E7EA01D8E4A22FC48942972", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658392123, "uuid": "a5e881f2-f68a-4ffa-a9ac-4a0bd36c5d60", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658392123, "uuid": "4540d277-566e-4e8d-aaf7-fec9a8323c68", "value": "12288:BP0uBT2iNgx8wHWYaRNx7MPIFooCEA8tb9Yt1CQo4:Z/T1+x5ha57BooCE1nWw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658392123, "uuid": "0f42b26b-11e2-4fa1-84ad-a39c9e1a8b59", "value": 591872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658392123, "uuid": "60e68af9-0fb0-49a2-9c09-27095e186a92", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658392123, "uuid": "722e7b52-a975-4a06-880f-82b1306ef327", "value": "VQC612aN8kkRJe9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0aa9dc5-0927-11ed-93bb-42010a9c0043", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1658430239, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658430239, "uuid": "b14fe942-3966-4aac-9248-1ff2f35d5cc2", "comment": "Malware payload (SnakeKeylogger)", "value": "05ab8ad6fdde78c4df412a8dc405d0ac", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658430239, "uuid": "3e4e1dff-c7cd-434e-97c9-a7793af68cdd", "comment": "Malware payload (SnakeKeylogger)", "value": "7370349d22f65927955d817fde07a3c9e1b5235fe3091278ad6899d8026422e3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658430239, "uuid": "2b698821-4b11-4559-9674-a01073cd86b7", "comment": "Malware payload (SnakeKeylogger)", "value": "09f075cf6e781a7b2cfa0988ae49062cf51640c8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658430239, "uuid": "cda3b464-a5ef-4820-9f58-53ec3993e2f3", "comment": "Malware payload (SnakeKeylogger)", "value": "d7f4022e3740b821bed0bed89ba3b24269ed89ce057ba83edc9bd33205ca0adbc03adf255159593769ac024b9ceec09f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658430239, "uuid": "3de6ae58-3512-4cc3-9093-67732a133aaa", "value": "T1E4C4F13371B7F901C53847B380E322580AB2720EB47BEE1E34AE655A85D27D69B417E7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658430239, "uuid": "78c09ca0-9bd7-444e-9d3f-d3612ffc5755", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658430239, "uuid": "109fe954-70b8-4edd-a11c-c3a93b295e09", "value": "12288:F3Qgg31hmx8xQ5yf08TV1bFPBvmbugz9/a8h:MmxOQoc4bFPcz9h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658430239, "uuid": "72fa1b62-a739-4b74-a330-b256bf7b526d", "value": 565760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658430239, "uuid": "7d7b8461-14ee-48e5-8b27-eb260af55dfb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658430239, "uuid": "0ed6cf79-26a3-453f-8332-bcf1263cb429", "value": "Remittance Copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7370519f-08ed-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1658405145, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658405145, "uuid": "47951742-434e-4fc0-bcbb-91de90ef04b8", "comment": "Malware payload", "value": "366134f007de0bede5afb773774c4064", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Ermac", "colour": "#43BC63", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658405145, "uuid": "01ecce8c-a9e4-4169-b685-4adcae71029d", "comment": "Malware payload", "value": "739d83c8ca63e674d56bc4c6024eac790d66d460c27437f47009fed834d47feb", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Ermac", "colour": "#43BC63", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658405145, "uuid": "c72c985f-d4fc-4c2c-b110-e47324eb2c1e", "comment": "Malware payload", "value": "62bec235f1067baf34a0d0b93dfb63e554e65071", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Ermac", "colour": "#43BC63", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658405145, "uuid": "cc246824-6efc-4e5b-8e54-86233cfafc0b", "comment": "Malware payload", "value": "e76be29f2abfd7538d4f8b360502893248b6d172092cbeafba3a8c6a990ea01cfcbab30bd7163621c6482dfa47f072fc", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Ermac", "colour": "#43BC63", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658405145, "uuid": "16cb449f-e991-4567-ae77-5626875387ae", "value": "T1C3B5F142FB86A8AEE8F38336473A475A91028D168343D787B95C753C1FBB9C08E55ED4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658405145, "uuid": "17b8fd5f-53e4-42ef-a1ff-104750d3ad0c", "value": "49152:exu1Da69wU3VYuxhVCrvSU4fqrHvQBTR1oGiMl0:0uDauwUFYWh/UbvQBPoh1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658405145, "uuid": "b7e3b982-b59e-40ca-ba45-7c70a9c1c873", "value": 2341048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658405145, "uuid": "e9e9093b-672b-47ab-bc85-b04605b40e31", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658405145, "uuid": "a5324aac-eee9-45d2-92ea-7fee937ab315", "value": "36.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fdac8677-08ef-11ed-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1658406236, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658406236, "uuid": "59165388-4c89-4eff-8c9c-ada9f0c500b9", "comment": "Malware payload (AgentTesla)", "value": "8d08abc7b2a18f8a60b77e0be81d8094", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658406236, "uuid": "dc687dcb-5d64-41dc-8865-45014dcf1229", "comment": "Malware payload (AgentTesla)", "value": "74973603dac46cc748a587ef2de2522fa3e5f08862126e916520969f3f444ff8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658406236, "uuid": "73a6be51-2cea-4f8c-bb9e-4318e32d0057", "comment": "Malware payload (AgentTesla)", "value": "13256ac077807109ff5af37d05f0fabb86ebcbe1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658406236, "uuid": "c6acad1b-e9e5-4b04-a7e5-1d0da8f6d01b", "comment": "Malware payload (AgentTesla)", "value": "f0ea360324851aa43a79e36bf99db9dac4323b6ee30e57afc1d9c35b3c470a0484015c967a66bc3409417a7f50e2249c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658406236, "uuid": "b10e8d71-c797-4807-8efd-1ccac97ffba5", "value": "T1A6749E5BB68CB78DCA0AC9B178B44E345610EF771616C603B4C7FE6C85BC69E6B500E2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658406236, "uuid": "abc3a8ef-fd60-4372-94f2-0e737e9bf6b3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658406236, "uuid": "7b69d4f1-ef26-4ba5-8e7e-0ac72ed12b58", "value": "6144:FlxHIFgeuFxZ2SsZRCQ8R1s9DFejAsDYPocB:RIFcFqSsKw9DYAsDYb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658406236, "uuid": "07111950-e8ce-424b-9c7f-bdb114366f8a", "value": 347592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658406236, "uuid": "62980e93-9449-4b04-8e09-0e7f181ef1be", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658406236, "uuid": "e280fa39-7554-4d7b-b3a8-84baa0867a6c", "value": "Sat\u0131nalma Sipari\u015fi -20 0652022 _July 2022,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10e98ceb-092c-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1658432038, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658432038, "uuid": "d41103c4-5a54-4387-ad1d-eefd5ddada90", "comment": "Malware payload (Mirai)", "value": "4b8cdbf9f2734c823e4938ecdcaf6456", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658432038, "uuid": "537c1da9-8e94-4c83-af39-979042afaf30", "comment": "Malware payload (Mirai)", "value": "74ac6e9a283dac2f090824798983d8f12fbfc405d9cca3a4132d788d8db80429", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658432038, "uuid": "384c5571-6122-4693-9b65-8acf263b4f62", "comment": "Malware payload (Mirai)", "value": "bdd3cc09f935e2e9b922eb02a80ca02f7c888447", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658432038, "uuid": "4b2a5e73-321a-4a49-bef6-83e03f445897", "comment": "Malware payload (Mirai)", "value": "9524f3b9e89260ed7b651d06ae552e6bd9a11caa0a8b6f9b659d032d0c17ef169106786d3d17533ba35fa08eecf030bf", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658432038, "uuid": "ba48b42c-a076-45b6-9bc9-fc601ebdb0d0", "value": "T1C033F255B4447551CB703637F8321197BF4A0BFEC2E63837056843A8A8E94A33AF6CA6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658432038, "uuid": "42055e38-608a-49cb-a56e-670f58b4b792", "value": "768:yMte5B4PACtw/YcmRIe18D9q63TxZQbSORe7Su2QJnKE79TLrPAB9q3UELbOs8qI:yM84ISRX63dZQbS5rzZPnLIVmWj5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658432038, "uuid": "18d2b08a-c6d6-40be-871c-8f9159561596", "value": 53620, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658432038, "uuid": "8112eb47-6ced-45dc-9196-4540946fcec5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658432038, "uuid": "abadfb20-ccfd-4254-abd8-f9047382c6ff", "value": "4b8cdbf9f2734c823e4938ecdcaf6456", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93c0d780-0924-11ed-93bb-42010a9c0043", "comment": "Malware payload (Loki)", "timestamp": 1658428822, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658428822, "uuid": "d774cdbd-86fb-4a59-9a5f-72b96b2a21a1", "comment": "Malware payload (Loki)", "value": "3a55eb0330321884cb2bc53005b5132e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658428822, "uuid": "2d528efd-3433-4ccb-b5af-11ad4a060b75", "comment": "Malware payload (Loki)", "value": "74ac7ead214cbcbdc49a18f1ab29d3b9f2a6a86af34e1611491bcd8f55a6e34b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658428822, "uuid": "0d0be265-05be-4bd7-aeda-0769d1cc068b", "comment": "Malware payload (Loki)", "value": "b8fa7763cb517430a78a2ad55ebb9f116381e12d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658428822, "uuid": "07e5db00-0891-4643-bf22-bbfba13d38ed", "comment": "Malware payload (Loki)", "value": "fac1bdf6d02bffd3af71e4b4edc848dfa724870c9e923bd90e72ef7f068d093b7875f24a12fd2da912b70684579d40e2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658428822, "uuid": "8e4d3abe-7ad5-4f9e-b345-a533d7aabb3e", "value": "T188D4BF19B6A7CD03C37C17B7C8D2004493B18A15D16AD78B2FCA22D62E46BE6DDC9787", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658428822, "uuid": "164a5872-85fe-4da0-98bf-c21d35c997d1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658428822, "uuid": "93776ed5-035e-4df6-bed7-e3f7c474650e", "value": "12288:6MPshaMk31hEnzwyhJ5kaJKUNOOXxhYZTRw:FmaREzwoJ35hYZlw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658428822, "uuid": "92f004f9-7dc5-4048-b212-f885d0a09882", "value": 647680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658428822, "uuid": "d11e1d9a-b25a-429a-b394-88d34788b879", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658428822, "uuid": "a83b571f-27d7-4859-9960-0a6bcd1091d5", "value": "3a55eb0330321884cb2bc53005b5132e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3bb390ec-08f4-11ed-93bb-42010a9c0043", "comment": "Malware payload (GuLoader)", "timestamp": 1658408058, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658408058, "uuid": "e5f95dc2-880f-4015-9a5f-f2be9228e4d4", "comment": "Malware payload (GuLoader)", "value": "41bd0682b694583a44500d4035904843", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658408058, "uuid": "73f2c68f-9a25-445c-8d33-fd0318049e1f", "comment": "Malware payload (GuLoader)", "value": "7500744cb96ef00da3854791e50622a7c5c0e1cdcf0708c7a7755070509d90b5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658408058, "uuid": "826b91c5-9e3d-4bea-a9d9-278f1a9a9323", "comment": "Malware payload (GuLoader)", "value": "b347b198fc8cadcd7c332a58e96e36cc3aa66e99", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658408058, "uuid": "68258e36-e30b-4233-aeab-afdd14779ac3", "comment": "Malware payload (GuLoader)", "value": "8855c6880cf3a430db588fa6297accb6f6eef94ae3bed4f5dcc4d84d62ee29b6e326cc5612c24bdada6c5136cdde5ee7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658408058, "uuid": "f817ef09-7346-409a-a6a5-58e054b21181", "value": "T10AE4F8655532B807C1C789B0F53082F69F606D9458F3885F26E1F74AEDBFBA10A27887", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658408058, "uuid": "f9602049-17ac-44e7-af16-741cfbc9cd4f", "value": "5f0c714c36e6cc016b3a1f4bc86559e4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658408058, "uuid": "b12d16b7-c4c7-4a60-8ee6-8e3a87633291", "value": "6144:71ssjoruNxdoWcofJfBxzKQPdJIwAIk8+44GI8uQd5xEOKz:qsMQEAf3xvIYk8U9xz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658408058, "uuid": "a9b84ec9-ec9c-4b44-b0d5-18268cc204da", "value": 665944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658408058, "uuid": "a6e7eafe-61dc-4d6c-9b4d-1fe729508f05", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658408058, "uuid": "698a3416-d327-4865-9f69-767cbe836d06", "value": "AWB# 6174229350.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a039025-08cf-11ed-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1658392325, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658392325, "uuid": "9daabe77-075c-458b-881f-b405a8a0fbf4", "comment": "Malware payload (AgentTesla)", "value": "9d4e2e3917c0c7631f8faea07c9c083d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658392325, "uuid": "98594b45-4e6d-4614-aeae-f09c2a463972", "comment": "Malware payload (AgentTesla)", "value": "77dbe90eba5281ebfb4d4386c4de21421863908a5d6323b626e15820e2d013d2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658392325, "uuid": "a4dd182b-247f-4108-8696-adb754a280f2", "comment": "Malware payload (AgentTesla)", "value": "f8ca0610846df757ef5ec3014c8d4e00d4876a6f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658392325, "uuid": "928df35a-5428-4505-9449-99d765e66fae", "comment": "Malware payload (AgentTesla)", "value": "7d51d053c94e95a652cfc613224f453fdd2fda7530360557230e23234a91da02f1624b4e9f0a609e6fdee833b585b96a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658392325, "uuid": "81b40dc0-759f-4580-b787-d25b23641a06", "value": "T14344E006B3D28213C068567290E701E707F4E74B2E73C7966CC672AD4E5F7DA6E06AC9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658392325, "uuid": "eb66ca7f-22cd-4161-a6b2-eeef438c8559", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658392325, "uuid": "7046876a-703a-41de-bb36-9cb6d4d5d6c8", "value": "6144:IMwjbAAu13ZWEyMznFGKAKAA8nTRoJ8L:d0bAAu13ZWkA7EOTR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658392325, "uuid": "95621276-adf7-4262-890e-78ad4dfb741d", "value": 275456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658392325, "uuid": "347dad9b-e12a-4c66-ae1f-cd37f49eb3b5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658392325, "uuid": "0b5ad1c7-4a7b-4c2d-86c3-dd873c9f738b", "value": "Awb - 1666547433_INVOICE AND SHIPPING DOCUMENTS.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa641f9b-08be-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1658385051, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658385051, "uuid": "d781e96f-2a70-496c-817c-1f8b73d5d329", "comment": "Malware payload", "value": "79c8aec89b55f0fd893c5358cfe66634", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658385051, "uuid": "d4e35114-1b15-4908-a8f3-95d156066807", "comment": "Malware payload", "value": "78bd069d6b2a1e617941b71b6953e0a8c792f49d3afbf3663610d60e280048fa", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658385051, "uuid": "348fe586-71f0-4e65-a251-c84cefb0186a", "comment": "Malware payload", "value": "cb1065ed12890f9dfa599e94c559626129f9efcb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658385051, "uuid": "6b8cb83d-2bff-4838-b35c-50ad500ff1cd", "comment": "Malware payload", "value": "43f37109462c5b368f99768feb84f6c85a33eb9382d02dea34953e71790b89fd9df934ddfd73c6dce4422f50e87df1c0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658385051, "uuid": "b2337c3a-ffe2-4622-b368-90ee8a2f55a9", "value": "T1546401C54A18E1D3F3B8D5B4D4B0DBFB82B82B756CA14604A1F9A5EDCB3E7262D05112", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658385051, "uuid": "79147368-6139-4e45-9370-c4be6653a468", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658385051, "uuid": "1088ea1e-21c7-40f3-9227-28da72bb089d", "value": "6144:L2CgfxElP8isat6Z475cw0npnlSLmarpUguiVuVTEryN+9t7NS:L2YR2DEknwaaFUZiVuK7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658385051, "uuid": "6cdd0676-5185-4bc8-aabd-9c4783acf665", "value": 328192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658385051, "uuid": "db641c76-01c0-4375-82bc-c8515ea391c9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658385051, "uuid": "4e0c5885-8ec6-4861-aec8-1e2a05201860", "value": "79c8aec89b55f0fd893c5358cfe66634", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52571bf5-08c9-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1658389628, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658389628, "uuid": "c6f0bc8a-5cc9-47ab-a0f9-1836eac36abf", "comment": "Malware payload", "value": "d652cb4e6933390e8650bfe3c380729d", "object_relation": "md5", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658389628, "uuid": "bedf4ea6-60c2-4e0c-8f74-54df06fd8e24", "comment": "Malware payload", "value": "78fd41ce2af702ed650e98fe332fd45f4782956fef69a77046f9b14b0a18dcb8", "object_relation": "sha256", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658389628, "uuid": "7765b48b-3acd-4c0c-aded-352b9025900b", "comment": "Malware payload", "value": "feb3679e4932ecfa0fce90b819feda7aa5ca6d75", "object_relation": "sha1", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658389628, "uuid": "db12a178-4a49-4bab-bd7b-dfd4a2cf3bbc", "comment": "Malware payload", "value": "dc564f062dc7078d19ef3f441333c0725049074a8c06ba0a270eb6e9e10e5ec348a3941af0a9f90eb4e0aeae57229a44", "object_relation": "sha3-384", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658389628, "uuid": "714a22e2-30e4-43cb-8fa8-d29504c72ef5", "value": "T1D314123AF21ECA52FE76D77487F21E00E560BC60D91C878D5A2231BD667DC205AFC1A8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658389628, "uuid": "6da98585-f797-4d75-a9db-c128a7a72e77", "value": "6144:bXg0POVrQD0dAs+VFfYXMJlQ3e8XSs+yZ+Q0lo/JVM:bsi4xMJlQurDy4Q7JO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658389628, "uuid": "ae526ada-e169-4f2d-8d2d-d6ee7cd490e4", "value": 204288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658389628, "uuid": "e97cfbd3-dde3-4e19-b0b6-b896528d53bd", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658389628, "uuid": "a411fa4c-7694-42c4-9042-95f2f726db4b", "value": "Products_list.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d7bb03c-088b-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1658362883, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658362883, "uuid": "9aff8b65-eae6-4689-9044-a74ed8594023", "comment": "Malware payload", "value": "5cefca74b718d85fedbfe12f913674d8", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658362883, "uuid": "8c60ec5d-2230-4618-be66-482ebab9c3f6", "comment": "Malware payload", "value": "7ae3917785e63df04b8f27072bd548b229d2a06646c681a19d1c4e3d69da2c35", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658362883, "uuid": "e4f39de4-7ad7-4a1c-ba13-ace57740f199", "comment": "Malware payload", "value": "04373977441e1b4cc44840d2db8a6d9821d4f31d", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658362883, "uuid": "5d72621f-1d32-40ad-b056-de523c10d4b4", "comment": "Malware payload", "value": "5eb1d476f678fc3d0f2fc25434154741bcec99f594544e492c6c20008ab9a6c530fb6ebcdb9b614b31340ee78adb097a", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658362883, "uuid": "dc71ac63-2141-4849-800e-90f2fbc9b088", "value": "T18ED2D09EC8BABDCDDB9C4CBC998A16B18A44FAC0B21CC75DC315DC5D920790FB64D884", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658362883, "uuid": "1214b512-4ff7-4281-9a9d-8aaf53d48ece", "value": "384:k75m4u5FhKYdvn/KmR0RaFz7RVgZictd92bzW+caSV+OAPB/4+8ARWGVCzhMhHT:gBuxZdvimeRaFztV2d92bzBPFdWMz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658362883, "uuid": "3e186ac3-2006-4e43-b467-bf894d7eddf9", "value": 28584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658362883, "uuid": "0747fce9-3b1a-4d77-a0e8-33a69c7acf7d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658362883, "uuid": "7f4189ba-bf60-44c3-9202-bba6f2f2d8cf", "value": "yakuza.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81571557-08b8-11ed-93bb-42010a9c0043", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1658382405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658382405, "uuid": "7135e13d-7a72-4cf9-a7be-2f0f1e637f24", "comment": "Malware payload (SnakeKeylogger)", "value": "a418ff2a1be4f505add7e55b5a90ef9d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658382405, "uuid": "68518011-a56e-45c1-867d-5ecffd644836", "comment": "Malware payload (SnakeKeylogger)", "value": "7c0ccddd1e886d81fbcd8e4c62e6d61ce7e78258825a1f2ef1bc7edca4179cd5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658382405, "uuid": "446d283e-fc53-446c-857f-b9e710ef5cbd", "comment": "Malware payload (SnakeKeylogger)", "value": "b9c1ea838e0cb697749e50347ed64e69d6b274aa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658382405, "uuid": "0b3d7cdb-5367-4d4e-bb0a-a1f0fbeccbfd", "comment": "Malware payload (SnakeKeylogger)", "value": "9d584273c4e44d09ff8ca9089f5c280f787d08872ae89a517bd87d16a9927dd49ce1b46aa578f0198094e38f48550785", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658382405, "uuid": "d754be91-10e3-4aec-9fbb-47ed434d070c", "value": "T1D6C4E00072BC9F92D5BD87FE5475948103F62B1B622DE3590ED2B4EF2A7AF514A40E0B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658382405, "uuid": "14464eb0-5935-4d32-bb9f-0e0938fcf4f4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658382405, "uuid": "d3045741-3b84-4bb6-9347-f36534c36d75", "value": "12288:/R831hPK2B5vXSAnqateZf1bIDmDyLP6:ZQxL/SqqatI1bIDmDyD6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658382405, "uuid": "40c6594c-ca0b-4dda-bf0e-b8865bf18d18", "value": 562176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658382405, "uuid": "34f02daf-7635-4c85-a52f-a3212208c463", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658382405, "uuid": "3be62eac-0f8e-4b3e-bc4f-df9d871beb74", "value": "QUOTE TKHA-A88160011B.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0751b51-08df-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1658399234, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658399234, "uuid": "0a6a7b40-a9bd-4133-beb3-beca70f8a83f", "comment": "Malware payload (Mirai)", "value": "53e6c166cee0dd7a69b21f47061fd003", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658399234, "uuid": "da8b43b6-16fa-4063-acf4-3fe66ed77b39", "comment": "Malware payload (Mirai)", "value": "7cbe773ce7ff9d611dc6c8f58c05134976b599c9faf96743de24d51321bbafbd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658399234, "uuid": "8ec2d215-fec3-461b-b9f1-c3102585d805", "comment": "Malware payload (Mirai)", "value": "3b34666aaebb08b0c8f6206497325633b149754c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658399234, "uuid": "a9709157-93c6-4e8e-805d-ed41baaf666b", "comment": "Malware payload (Mirai)", "value": "b1491370baf72b9f53685bebda8e56d5daac928a8b1c2b87c366cc8f041ef827d119a84500c88ad84570bab39ecb6ca1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658399234, "uuid": "a1948686-f515-46a3-a15e-64b4fa1a455c", "value": "T1FAE208C9F543C9F5EC4205706476EF339F32B6E96258DA13D3A8D626E8A2502E803D9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658399234, "uuid": "b046bf19-bdc1-4e9b-b3e3-d5f6bcc4746a", "value": "768:l/cs0Sr8rhChIymiVkLEDLvDPJyI8tilu6sj:lks0Sr8dChnmLADbTJF8sluH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658399234, "uuid": "92cdcd78-af43-47ad-9d66-187d02e3129a", "value": 34128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658399234, "uuid": "ddcd91e4-13ab-43b2-9308-5d74268d83f6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658399234, "uuid": "db4b99f2-af54-4889-9544-b2ead61b5395", "value": "53e6c166cee0dd7a69b21f47061fd003", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b127563e-090f-11ed-93bb-42010a9c0043", "comment": "Malware payload (Armageddon)", "timestamp": 1658419851, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658419851, "uuid": "7ecb9e79-cab1-4a1e-86a6-7d189c05dad0", "comment": "Malware payload (Armageddon)", "value": "b059ab7a19bc94ce84c615b83cecaecb", "object_relation": "md5", "Tag": [ { "name": "Armageddon", "colour": "#544E8E", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658419851, "uuid": "68fba1e3-e963-4784-a346-d79f1665c8a5", "comment": "Malware payload (Armageddon)", "value": "7d2ec4837172db84721093fa6806bc2b61a9ea7169818a6e0ea1c92ed0f602ff", "object_relation": "sha256", "Tag": [ { "name": "Armageddon", "colour": "#544E8E", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658419851, "uuid": "bd086c13-2258-4720-b38b-b3d7898c364d", "comment": "Malware payload (Armageddon)", "value": "ec2bee4a9727574f538c0d21100ab1491691a0f2", "object_relation": "sha1", "Tag": [ { "name": "Armageddon", "colour": "#544E8E", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658419851, "uuid": "3a937928-3c87-4e9f-bad8-cdf0d50ec946", "comment": "Malware payload (Armageddon)", "value": "8028bcc30a15da59fb5988529ea4ba2c0b89610a45c8731b796d4f2778431a5850018356e6376bfd8cbd55da33ba0e9a", "object_relation": "sha3-384", "Tag": [ { "name": "Armageddon", "colour": "#544E8E", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658419851, "uuid": "01020e68-c7f5-4531-ab10-6e840a907a53", "value": "T195D38B13B446992ED76801314AEA9FF933B19DC98C41AA0B362DF38D7C7E234DBD1984", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658419851, "uuid": "3ff3edc6-b483-4699-9db1-b06843fc2a0f", "value": "3072:RKdSoIlXPNPujkhsXCr6W+khGsrZyV2NbsEMliO:3PPgkhsyr6W+EMlH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658419851, "uuid": "03c1fe91-bd89-45e6-aa4c-afe89655fd8a", "value": 141312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658419851, "uuid": "b4b6f916-9a6c-4d23-8b2e-dd711bd4db77", "value": "application/msword", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658419851, "uuid": "08651d11-4b79-40a4-9bdf-335f1b2aab0c", "value": "b059ab7a19bc94ce84c615b83cecaecb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19ee8449-0928-11ed-93bb-42010a9c0043", "comment": "Malware payload (AsyncRAT)", "timestamp": 1658430335, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658430335, "uuid": "69a7005c-26e5-45eb-95f5-bf72e1461e05", "comment": "Malware payload (AsyncRAT)", "value": "0ba4410483567d5933de7ddbdbecc6e8", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658430335, "uuid": "fb2a1731-c5c4-46ee-a00e-761b6e0033da", "comment": "Malware payload (AsyncRAT)", "value": "7d64bf35c35c36d2cf7fcd3f9d064b658a9b317ca280c1aa949cdf0db82c38d6", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658430335, "uuid": "204ebade-d742-4da6-8252-214532d33a18", "comment": "Malware payload (AsyncRAT)", "value": "2d766569cee08227882b6939401e0586500b17ab", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658430335, "uuid": "d30fc9af-a2cd-4fd8-9948-ec5865ccfd0d", "comment": "Malware payload (AsyncRAT)", "value": "4d75c4f46e7a8a8cf7c2345e0456b60848eca40308060902ec558c0da23b1a4fa9959f681b859846db3b1da71cb9a155", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658430335, "uuid": "4c2c4b52-4275-4275-a1bd-afc295dc5b51", "value": "T11284B428EB5C280FEC811DB2902A26D7A53D7506F757F28C02F4CB6F6158E67AAD5433", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658430335, "uuid": "2d2578b7-2278-4286-9895-0d7e82b877ee", "value": "6144:Vv0fBmOFWvFJVjljMdVYU1zTDpMOIJYLevYAxsXF6giYV0iUsfMhciu2inj0zJX6:I5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658430335, "uuid": "3c913349-ff90-41c4-8360-bbd24409a55e", "value": 399720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658430335, "uuid": "03a0dbf4-1e23-4f0f-bf12-ccbb1661a2e8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658430335, "uuid": "260f138e-f455-4e6f-9bd6-beb641efb5f2", "value": "0ba4410483567d5933de7ddbdbecc6e8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7934a68e-0903-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1658414604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658414604, "uuid": "4d69546e-332f-45b7-bd23-b30c70e437f5", "comment": "Malware payload", "value": "db6b667ce1325acb529522d4cc45dd45", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658414604, "uuid": "57197d9d-0500-481b-afdb-e2a9d917c934", "comment": "Malware payload", "value": "7dbe5c80259b6a844a81da0ffba7352d9f8cd32119d5bb1d658fccdd33b1457d", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658414604, "uuid": "bf64d7df-e206-4bdb-8562-3d27d9a52035", "comment": "Malware payload", "value": "220a7e0b3f0a88fe04179f5e56e7ed747f90a35e", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658414604, "uuid": "a9f18408-359e-4839-bc5b-01a214eb5adf", "comment": "Malware payload", "value": "1fe755eb761a2e9bda087b9ccaa262257f4a23c1e8791496a7adf271ecc663720ccce4e9d6bd4ae337ff15142433ab01", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658414604, "uuid": "5315c81a-2001-47ce-a1fc-cad79700a8e9", "value": "T1A8373357FD9AE725E833A23493695A57D080013DED0CF1A56FB5909C4AEBE00D24AFF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658414604, "uuid": "ae88a899-41c6-4f71-9c69-3f0879e27b8d", "value": "393216:VoKNZBXEhv5XRI3N0B8gms2kk/LOFvrR54mbU4ooedH0IIBTfZHX5zU4:VzNZBXEfXJ8g7PjRugDoPdMBTzU4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658414604, "uuid": "65019d87-805d-4355-b4e1-09f1b67e8b2e", "value": 24254455, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658414604, "uuid": "cc35cc7e-e30b-4280-aea1-616fc9120b52", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658414604, "uuid": "453fa6ba-bbc1-463c-900a-e61bda404080", "value": "client.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81064341-0939-11ed-93bb-42010a9c0043", "comment": "Malware payload (RedLineStealer)", "timestamp": 1658437810, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658437810, "uuid": "6eff2f6c-aa50-4bbc-820b-657ee666dc7c", "comment": "Malware payload (RedLineStealer)", "value": "55809cd84fbf79137efd38ffdb84e2e7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658437810, "uuid": "56ac8037-0081-4045-9431-dd6ff675cc89", "comment": "Malware payload (RedLineStealer)", "value": "7ef7259f3ba8cf8c6444f82a4092066d624c5de4f9c72cd3a0031dd4364b97fa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658437810, "uuid": "88f33b74-b039-43bd-bbc9-58c8db7b4087", "comment": "Malware payload (RedLineStealer)", "value": "0d908875f7790d1906ae33b7db9e94f7a6c59494", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658437810, "uuid": "2ba0b390-85d1-49eb-be46-bb90fca20fa6", "comment": "Malware payload (RedLineStealer)", "value": "00c1e46eeaa9fec30ffcb0b7c31e32479a6cecabbb2a9450c98fa64ad7bb36b83aadefb582cc58c58098d4cb64ab0af2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658437810, "uuid": "5ecf3bb9-977c-40b9-b35f-ccaeb8039480", "value": "T14D54F11276A0F830E5D645355874CFA569BABC629674408BBFE43B6F3F302C06AB4367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658437810, "uuid": "55124242-4adb-4252-aaf2-2254456321bc", "value": "07435f16da9029fd6eddc0cf898ffd9b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658437810, "uuid": "756b1a8a-885d-4855-abe0-b3a085f035ca", "value": "6144:5484HaScAy4icowN9ewuxw80MdEtV2hvAojkX55MF5Jnx5:54LHaSch6gwtudLvxjIkBx5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658437810, "uuid": "9f1d6d34-3ce7-451f-8fee-f56ec058bf94", "value": 299520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658437810, "uuid": "27f2157f-1c51-4859-8ce4-f38e065b851f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658437810, "uuid": "47944c91-8058-454f-bffe-54efb367682c", "value": "55809cd84fbf79137efd38ffdb84e2e7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89118a57-08be-11ed-93bb-42010a9c0043", "comment": "Malware payload (RedLineStealer)", "timestamp": 1658384995, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658384995, "uuid": "313fbdb3-eec9-4525-8851-a90cc46059dc", "comment": "Malware payload (RedLineStealer)", "value": "ca9ae557fdca0afb5911b5ce62d200ef", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658384995, "uuid": "f3625e2c-7349-4f36-bd4a-3c128688f146", "comment": "Malware payload (RedLineStealer)", "value": "7fa1004ce473bdc7304da7580775a50ba57c0225e91362e868c2df2a60588cc3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658384995, "uuid": "18f3acae-2ef4-4302-952a-75b02a223f64", "comment": "Malware payload (RedLineStealer)", "value": "0816a2ab976b9be91f7587eaddca610e59feed14", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658384995, "uuid": "ec6f575f-dd94-400e-b2ac-f7080588f2dc", "comment": "Malware payload (RedLineStealer)", "value": "f9d7df892da5a547a807a3d2111b53a7a905a36a5f42755ec3aede57f66f881b3e1a857e2f1a6e1cb7912f7faa6675e6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658384995, "uuid": "003adb38-6358-48ad-948a-0f5a191a8545", "value": "T1B684CF041B48583BCDD19DBB0E15C36A66A97B8D3F5B589032C89F8BBA05D2B53C5FC8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658384995, "uuid": "79ea5568-8750-4f92-9e2d-4d14adf3d807", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658384995, "uuid": "b6ac8adb-69ed-4236-a064-f93ef3948aab", "value": "6144:+87WCb4rj7UtLmUFl2DrNWoWWIuhFYSpPxtgD5NHTlAz5HW99LxX3OHxzht:17arfQgDrTW8XYyPT4Nz4529mJht", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658384995, "uuid": "a4d1bf0c-e5e2-4bff-96b9-ca2d966dfa6e", "value": 382976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658384995, "uuid": "52a1e8a6-eaed-491d-ae33-a4408a5e2db2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658384995, "uuid": "c01d26b7-0153-440f-b783-3e420ca6534a", "value": "ca9ae557fdca0afb5911b5ce62d200ef", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f1a7bda-0928-11ed-93bb-42010a9c0043", "comment": "Malware payload (AsyncRAT)", "timestamp": 1658430424, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658430424, "uuid": "a3cd71bd-212a-4c55-9417-647dcb1d5fab", "comment": "Malware payload (AsyncRAT)", "value": "767233f6b86f57b38100899a5b60565f", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658430424, "uuid": "ff30ab34-0192-458e-84ad-f4025b0799d7", "comment": "Malware payload (AsyncRAT)", "value": "80e823cba2d8094d9f83b6e7cf8f819d4ca0a6b6026e90c05110d22252d319d6", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658430424, "uuid": "20f9afc2-acb5-4b30-8948-7cf0da035c8b", "comment": "Malware payload (AsyncRAT)", "value": "3c41f7cc4bb11d96437a8f66ece5d87db2216523", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658430424, "uuid": "fb31adc2-ba2a-47c3-8d6e-b63ac2bd8904", "comment": "Malware payload (AsyncRAT)", "value": "10f02a5e0689be3b8159d72065cb7e3b8f742d16fcd1632b5b1d3865353ac8ce4bb4fb17dda955762fa5b67991d27126", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658430424, "uuid": "aac819f7-f57b-410e-8fbc-7032088b20ba", "value": "T1CBD301C4BD9DF94EC63BC279D49A8D798721B43F470BC24B54AB70A29D087D28D361A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658430424, "uuid": "9549cd47-3616-4d0b-8f50-e8553262855e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658430424, "uuid": "7f2325df-391e-4dfd-bf78-487f82b28805", "value": "3072:cBQDUARcdQmQcGs2VbNLbNffbOlh5Zm2ZEvSl9K:/zRvBVbNH84NvMQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658430424, "uuid": "11aa5018-148b-462f-9de9-9db40ea467da", "value": 134656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658430424, "uuid": "c3983c63-9b3b-434d-aeb6-25d03970654c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658430424, "uuid": "6681c897-a5d8-485f-8a05-99b4eb00d4c9", "value": "767233f6b86f57b38100899a5b60565f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "649d0d27-08f4-11ed-93bb-42010a9c0043", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1658408127, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658408127, "uuid": "f69c44f4-879d-4999-88a7-8c8ae1a127e0", "comment": "Malware payload (AveMariaRAT)", "value": "7099a7d89f6876500f5e1c73a47f9ddf", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658408127, "uuid": "800f4a1b-8b9d-4fba-9034-89bd5f777867", "comment": "Malware payload (AveMariaRAT)", "value": "8115050b039a64c67c668b93d1c7106f6ab758db5a037b4f08a46a39200d8c2b", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658408127, "uuid": "f7fde063-1fe3-4048-9c23-0675dafb378b", "comment": "Malware payload (AveMariaRAT)", "value": "8533797af1322e829ee42e15a137009b3c0f6f03", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658408127, "uuid": "9526ff67-d259-41a8-9149-46ebd975d993", "comment": "Malware payload (AveMariaRAT)", "value": "ec7440a4036d1a43ed504967b6f4f970b38bdbf43c1e7d3339bb1cfd8f26edc61a2f487545b458eab99aec138156992c", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658408127, "uuid": "3014ead0-16ca-4fa4-a4b4-33e48894b98f", "value": "T1C605123371F9AB24DD3497F211B2A2581EF3710E7575E54D28CEB9AA85E57C0AA003E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658408127, "uuid": "d760797e-54c0-4997-b3bc-f20e4538a398", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658408127, "uuid": "a3cd4ef8-3ea0-40da-ad0c-20ab7adacaff", "value": "12288:/spk4jYY9W4xRRL0bDtifJexD5UICtSNv0apK8+7bdhMvmb6SxhjbsuVloXWeTxj:VjETLYDqJ455X0Q+7+gjXVl6Wwxj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658408127, "uuid": "991d8aba-e082-4857-a5a9-5552bb2a3d1a", "value": 807936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658408127, "uuid": "f5df4336-a15f-4291-a180-72eebb1c9cb8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658408127, "uuid": "afd662d5-d956-48af-9c41-be9c793d1b51", "value": "RFQ097654345678998765.PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d80e0a1b-08bb-11ed-93bb-42010a9c0043", "comment": "Malware payload (RedLineStealer)", "timestamp": 1658383839, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658383839, "uuid": "45d541cf-cc29-47a3-96cd-f4edbe6f24c3", "comment": "Malware payload (RedLineStealer)", "value": "5c0ba75aaa256959fecd4fdd94bd826b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658383839, "uuid": "438c21ba-8d53-4193-9fa4-fcd689a2c2b5", "comment": "Malware payload (RedLineStealer)", "value": "8217e6c219f5728070112519a542c16e69633070c02e13b0648a01f4dbe3ddea", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658383839, "uuid": "2a01fe22-3586-4b52-8564-4820b857ab7d", "comment": "Malware payload (RedLineStealer)", "value": "06310c4ba044ffa4307ff79d70008bef6f49e651", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658383839, "uuid": "0d8b61a4-ddb4-4bd4-bbda-2ef4a02e0618", "comment": "Malware payload (RedLineStealer)", "value": "e0176ba00dab2e8801ab8dd275785f5aa9c936e9e70dc4693672a140e20c4db90bc3e630112cfa53f219624bd36c3181", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658383839, "uuid": "509d5da5-a31d-4b28-ae15-dcff02779195", "value": "T12854E17072A0C872E4A215306871D6B5A97AFC337574A58BB3543F2F2E303D066B9B67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658383839, "uuid": "d659c76f-ec8e-42d0-86d4-3d3f8eccd45b", "value": "401da744a568f91ec17ba84225e05b40", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658383839, "uuid": "3077c487-f263-41cd-a0d6-62f8dc43186b", "value": "6144:LdRanJJixY/918BoELcxFw7PUiD2TThFLJpYy3:xR00xY/UBGF1PfLJCy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658383839, "uuid": "979a230a-5774-46d2-b39e-6243aecdad5c", "value": 302080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658383839, "uuid": "b52f71bd-2604-4f46-8cb3-1d4ef8acbed9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658383839, "uuid": "b884a315-bfe0-46b9-973c-39a3c9a5cd11", "value": "5c0ba75aaa256959fecd4fdd94bd826b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a90ba6a9-08ec-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1658404805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658404805, "uuid": "c641b462-3bb9-435e-9c09-d74d148c7144", "comment": "Malware payload (Mirai)", "value": "38dbff7e434e98e19e063d453580b419", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658404805, "uuid": "3e4e8951-b39e-430b-84df-636b71b064f9", "comment": "Malware payload (Mirai)", "value": "824b4d4b0d8c93119cd7228be361743ca9b6e457f5eaa38caee3daab77ca6a8b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658404805, "uuid": "28bf841d-cb20-40fd-a920-3274edfa08f9", "comment": "Malware payload (Mirai)", "value": "dad2857127b4a3c578765d6530f4e64f59ca1340", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658404805, "uuid": "62f04b1a-68d5-474a-9251-1bf2b3733e4f", "comment": "Malware payload (Mirai)", "value": "eba84695a1684d0f710c0182003a98f53ace31b842927aa0e43f574a56f18c0f1059da1c8c5d4ee8837f557bdbecac83", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658404805, "uuid": "9e4d916a-acdb-4898-842d-6871a6319e34", "value": "T19E33CF771E17DD4BD285EA234C4C9DC9F1D2C2D262F70AE4EB912AF72C4606605E0AB3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658404805, "uuid": "32ab071f-4d1b-4842-b58c-a541a4d9abfd", "value": "768:3lOVI3aHHGON3oeAX/4oMOGxe0/McecZNvQTgJxNHm7BCk9QFNhSiT7lt+efcb5p:3lWI3amMeX/4SvceYlWJShpvJ25eU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658404805, "uuid": "54b17ba5-aba7-47ee-b99f-a416aa029b74", "value": 54200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658404805, "uuid": "873d5cf9-fd35-4079-a388-bee9a3522ebf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658404805, "uuid": "71eeac3c-c8b3-427d-898f-b8de89b137bd", "value": "SecuriteInfo.com.Linux.Siggen.9999.14967.4006", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0394c51f-08e4-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1658401092, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658401092, "uuid": "b85e8d9b-7541-453e-9c91-914ef9645269", "comment": "Malware payload", "value": "d428cbadec93f2c750e263ffa30c8958", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658401092, "uuid": "a0559311-b133-4c04-a1b6-daab67751ff8", "comment": "Malware payload", "value": "847ad79d7f990ecb8165d88de97de950d73adf31eac7ddcce891e2cc3cfb7efd", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658401092, "uuid": "3fac82ae-a736-4207-bf17-ca9a99bc4f8c", "comment": "Malware payload", "value": "ad644240fb3c551eefe3a16d0db563a15a5bfbbc", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658401092, "uuid": "09acc558-e5e3-4350-b5a0-dc6adccd4e8d", "comment": "Malware payload", "value": "0760f043ba8dae6b6ed3292acfae3c446b634b286b31846c644998f6d55c917371747a599cdbabdcf6f6c34805f2c51f", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658401092, "uuid": "cb0cc935-55a8-4a51-ae82-3a4ff03acc3c", "value": "T12733F52B62EE7EAAC5BA1A743B7353C0CB5DEE241403D62E15D4201FC97E24375623E6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658401092, "uuid": "a7d51a4e-3bf8-4a13-ae39-460f0e02f8ff", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658401092, "uuid": "7763effb-d859-4aa1-a6c9-f4a6a8a57480", "value": "768:ee7jgYiiCwprCCzhgUHaD0eBj6aTeI2IygqqcB+OnFGBQbQXwA3M4:JggCwhrzXHK0HaiIygbi+OFFbQXX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658401092, "uuid": "996001d9-ffa6-464a-83d2-6f38b035ee08", "value": 50176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658401092, "uuid": "2981bf3a-57e5-435b-bef3-3297fe0c24e3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658401092, "uuid": "7d077730-adcb-494c-9ce7-ba789bbc2f52", "value": "InternalAssemblyBuilder.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12410b07-0949-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1658444496, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658444496, "uuid": "8e26df45-cf66-4a2a-9d4b-da67d19a54e2", "comment": "Malware payload", "value": "d25e6bf761f140a7e7cea61bc9efbd4c", "object_relation": "md5", "Tag": [ { "name": "CL", "colour": "#5EDEA7", "exportable": true, "hide_tag": false }, { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658444496, "uuid": "e77afd93-cf0f-4c2e-b628-2478bb942023", "comment": "Malware payload", "value": "84a0f6fc57d0d08518d26233951c7c3beab3605924bb9c52c039a909329bcdf5", "object_relation": "sha256", "Tag": [ { "name": "CL", "colour": "#5EDEA7", "exportable": true, "hide_tag": false }, { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658444496, "uuid": "991d8e92-b1a7-4faf-ba52-af345cd71e13", "comment": "Malware payload", "value": "fdbb2c18e3598b03b48774605e7e96a08c077b8c", "object_relation": "sha1", "Tag": [ { "name": "CL", "colour": "#5EDEA7", "exportable": true, "hide_tag": false }, { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658444496, "uuid": "beff189d-1ea8-4e72-9c60-48c10e05560d", "comment": "Malware payload", "value": "3e26443ed87ec3fc546c73a4c0182528f6a7d391a7b4579d903630a84e67aa3d26bfa4eba9528efdc63f973b2bebe052", "object_relation": "sha3-384", "Tag": [ { "name": "CL", "colour": "#5EDEA7", "exportable": true, "hide_tag": false }, { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658444496, "uuid": "a56ff2ee-9256-4871-8fbb-dd5475103284", "value": "T10A75BF30759AC637E5BE4170252DCA6F51687EB10BB284DB63C86E7E09B19C14332FA7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658444496, "uuid": "110831de-8636-49f0-81fa-29af48cd1130", "value": "49152:WSgNitjVqoA7AwxDOjSETeVfb/6LY74d8nd+9W:9tMLAwOjSEPY8d8d+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658444496, "uuid": "5883f299-51c3-49c8-8477-efaae20743b6", "value": 1700864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658444496, "uuid": "246361d3-c209-48fb-b9d7-a26315ccdd89", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658444496, "uuid": "715e2410-d6e4-4f99-a81c-06cf4880f816", "value": "00EUUUETEUURYTR2022.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3f842c4-0935-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1658436204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658436204, "uuid": "0d4be2e7-7d15-4600-936a-f3a7c7bbac6d", "comment": "Malware payload", "value": "23e113b488f63cd1928af3c35b008b12", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658436204, "uuid": "16f29110-40bf-4c34-9f8e-2dbcbecd53ec", "comment": "Malware payload", "value": "84d7dceb3ef760471896823315127414c286393fe850369de594d80865efb386", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658436204, "uuid": "fc6636d9-0d27-48eb-884c-38c9225f5a40", "comment": "Malware payload", "value": "330141a92f2cbefb1d3076cbb0cff6d38e8e41cc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658436204, "uuid": "09c5bef7-5c36-483a-8361-c9b7754f8ca8", "comment": "Malware payload", "value": "e33a974d8dfbc28c8e34cef231185480b96a18abb17042de965e0cf783c2345badd7ff194a4f56dd514859bf524b9c78", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658436204, "uuid": "c4e4749b-c75c-4d39-bbb8-5ac4533e6da8", "value": "T1202501017544E1D3FD090B3299F7D67547A63E9EBD488A8F3284BF5F35B2A08601BA2D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658436204, "uuid": "d355fa03-dbd8-48d0-87d9-92b34eb7f4df", "value": "f10e4da994053bf80c20cee985b32e29", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658436204, "uuid": "f827de7a-73bc-4cfe-a3c3-70918271d671", "value": "24576:6O1HBtpTQvSAt8M5peZTrO0QtPwmxIwZUhZX5:1hT4LYh9QFh6ZX5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658436204, "uuid": "2390d4b7-ab2d-48da-a8e2-ce074e62f1aa", "value": 980434, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658436204, "uuid": "5c902c42-5fa3-48c8-a41c-083f7fe319bf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658436204, "uuid": "5f018163-9dfa-4a34-9219-2b5e4e507183", "value": "SecuriteInfo.com.Gen.Variant.Nemesis.9233.29061.4426", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10bce876-088b-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1658362889, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658362889, "uuid": "1f3c2db2-c65b-4b33-b4c0-efc465805b47", "comment": "Malware payload (Mirai)", "value": "bf7b166481d430430708f147e715c5d2", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658362889, "uuid": "311eb955-7386-4974-b1c8-621eed02c010", "comment": "Malware payload (Mirai)", "value": "84eeac76fb86c6d8862fc1dd11cd29b65b61acd93c7e2afeca5f38be7351b4d5", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658362889, "uuid": "66cc4154-c56f-4565-99f9-bb50e34ec103", "comment": "Malware payload (Mirai)", "value": "f2d830c578becaeb5276dd7674a7f901c98261b3", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658362889, "uuid": "5b4b6410-9335-48e5-9c35-c85a381b7ff4", "comment": "Malware payload (Mirai)", "value": "7eee0eeba9079a65d83fc28340152c1d4892b6f2ced5eed5a1bf9904db8a0b01e26e3511cd64d5e307775a0dbd8c9b27", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658362889, "uuid": "65ea5e6a-0ec6-4d52-8eee-ffa5e14c6f68", "value": "T1D7230291F6415E33F1F6C9FAC67ECB08E1BF9BE8605776D0700AC45DA663292A0F9901", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658362889, "uuid": "60421488-d89c-4243-841a-38111ce57f67", "value": "1536:Cv2axWBP2DjyL1ndxH5klWMhPeSuc73wOg:CjxWNwcnFcwR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658362889, "uuid": "a3c6e91d-d4a0-44cf-81b3-988f4251eb5e", "value": 50020, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658362889, "uuid": "894c879a-5606-45ea-af6c-7f0ef7be414b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658362889, "uuid": "7b034508-ebad-4717-a843-77cddf8052bd", "value": "yakuza.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1f7e296-08e6-11ed-93bb-42010a9c0043", "comment": "Malware payload (AsyncRAT)", "timestamp": 1658402297, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658402297, "uuid": "f1f60031-77ef-4034-a183-b826a538a92a", "comment": "Malware payload (AsyncRAT)", "value": "a8e3c45bbabdc785ee2f031d7b08159f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658402297, "uuid": "691601ec-e869-4ff1-a3da-0981498bd84d", "comment": "Malware payload (AsyncRAT)", "value": "85a13e4751a7a3dbccd46a23a441ec7838f5df8ce13f6a76e0347838200e47b9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658402297, "uuid": "7ec1f814-6b93-420c-829d-aeb7954caf21", "comment": "Malware payload (AsyncRAT)", "value": "eec1f6963ce8ed446e881313aecee14e46804c51", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658402297, "uuid": "f4da9f5d-e552-42d4-b130-56b9a9112902", "comment": "Malware payload (AsyncRAT)", "value": "4fe073aea450ed87ed2d77a64955d7b80555a86f0b05c5ed45617695b0286b4967e656b849e7a8586cb8e23306aac3b5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658402297, "uuid": "841147fc-85f7-47ec-af09-bf60eb0adbd6", "value": "T152536C002798C965E2AD4AF8ACF2950106B5D5772102DB5E7CC814DFAB9FFC64A133EE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658402297, "uuid": "c948e545-91f6-4fe0-8fa6-0779771dc4d2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658402297, "uuid": "cdebca95-f212-4a27-86e5-d4f07ebabc8f", "value": "1536:nhm5hc1kw0kdsvUHLdMoGbbvw0bmUGlZVclN:nhm5hc1kWdsvUrdRGbbvpbmpzY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658402297, "uuid": "1ef9b828-4111-401a-a473-b533aa540a9a", "value": 64512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658402297, "uuid": "c50a9f5c-0e4d-48cf-bba0-cf1471347609", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658402297, "uuid": "828908e7-ad76-4de9-b81a-192e4f62f99a", "value": "a8e3c45bbabdc785ee2f031d7b08159f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fa7859d-08c6-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1658388361, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658388361, "uuid": "cd0e98f5-fe68-4947-b1cc-9534a44f2f51", "comment": "Malware payload (Mirai)", "value": "eb54640768b15c0d259b11903b86513b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658388361, "uuid": "a8e024f9-1bfd-4650-8f56-033bb6948945", "comment": "Malware payload (Mirai)", "value": "85f6cc0cac8aba4159712b0cfb05b5c30f788def872819e6e8e1b15ce5c89fa9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658388361, "uuid": "bc2116fe-b34f-48d6-9541-d43c43ce710f", "comment": "Malware payload (Mirai)", "value": "a8451a5cc6ea19e1ebddf3833079eb13753bf564", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658388361, "uuid": "9150dd1d-b985-4414-9d92-155873dd92bf", "comment": "Malware payload (Mirai)", "value": "602d9a819721138fccfc0617485eaab35bac55a24f16db3f4a2370e7f7e1e8433426a0e0983e5049a7cc0b94e98ae8c4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658388361, "uuid": "5a3ae27b-1259-4935-a859-47e30fdc3f31", "value": "T12CC2D0F5E4A84DF8F2EB7AF01CE59EC062F55BA71B26D7F2A285CF1181201B12D059D8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658388361, "uuid": "1ed58887-a764-499a-82ea-23043c9b7204", "value": "768:8gY4/Mg0F2Vj1dHKzuJccbwyap94uVcqgw0RNWXK:8gYKMgbV5dqyJB3aP4u+qgw0bWXK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658388361, "uuid": "9bc52ad2-224f-4202-8e21-07e6ed7ea270", "value": 25864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658388361, "uuid": "49a3d415-4b87-476a-ba7a-fe8b8adf421f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658388361, "uuid": "1b111b17-86a4-402e-9d5b-ab8f894b88d4", "value": "eb54640768b15c0d259b11903b86513b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ef6c28f-0940-11ed-93bb-42010a9c0043", "comment": "Malware payload (RedLineStealer)", "timestamp": 1658440813, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658440813, "uuid": "18cb3a6b-22c6-4ef0-8a44-d2a5131b3deb", "comment": "Malware payload (RedLineStealer)", "value": "33e087792e8de2090cc349a80eb15f36", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658440813, "uuid": "83a151ee-0bf4-4f62-9c99-efeeaf9acbcb", "comment": "Malware payload (RedLineStealer)", "value": "86826dfcbb36cc99222d8a68d27b66561ec86506d9c07802b2a04fc043903e5e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658440813, "uuid": "ff0ca3f2-72a8-4293-8003-d29faec49e33", "comment": "Malware payload (RedLineStealer)", "value": "34243b80dfc45733d2e94ef6830cc2b13da47d1a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658440813, "uuid": "a7ce68bb-bb99-41f4-abfe-74b7cd48fda7", "comment": "Malware payload (RedLineStealer)", "value": "e44eb80b2adf4e02f31f8a767caa65e289c7657efa0320874c446e04e96dce3ff9bc6e8edb1c142111e98cbe85e9797e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658440813, "uuid": "fdb311b6-8706-4a3b-92a8-ea74e12f4745", "value": "T1C854F11172D0C833D6E2A6309874C6B26A7E7C736574818BB7A43B2E6F303D06676767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658440813, "uuid": "9cda4d5a-5e5c-49db-bd32-23ab7c7ac65b", "value": "401da744a568f91ec17ba84225e05b40", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658440813, "uuid": "e6847a93-8268-4622-a866-9c1921153b00", "value": "6144:87UraWijM3I9OpgedhknmTZ4GJqNnHRqnLQk3vc:3uR9wga6mTZ/SqLQ2v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658440813, "uuid": "c623ce43-3b50-47bf-b1e7-b43b1b7ce8c9", "value": 302080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658440813, "uuid": "a4fde195-46fb-470a-8d8c-879b93e291fa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658440813, "uuid": "e3b0d223-8104-473d-8e5c-75c178ec272c", "value": "86826dfcbb36cc99222d8a68d27b66561ec86506d9c07.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df509749-08b6-11ed-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1658381704, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658381704, "uuid": "7b222af8-6a71-49ca-bfef-30b274da5e90", "comment": "Malware payload (Formbook)", "value": "82fb573960a446456958c778300d50fd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658381704, "uuid": "6021c3aa-f462-4db0-a337-860e27687ea2", "comment": "Malware payload (Formbook)", "value": "8738509150857d74d2b7ce825078911b7c08e878269d5f870dd59131f0d7ec9a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658381704, "uuid": "7112accc-1a3f-49bd-9942-eca3fd7c19c8", "comment": "Malware payload (Formbook)", "value": "f6347a1214eb26b2f568530bd2e0dd61faa4c2cc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658381704, "uuid": "8d1d8637-af02-418f-9414-33905de1f0cc", "comment": "Malware payload (Formbook)", "value": "51bf8e3cd6826f16d0c3f8a9ee7231739b4a073358910eec2e70bd37a1d0a48803f8480f71eaf62913b7dba3d476fe0d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658381704, "uuid": "1069a319-db71-48b6-b447-3af4ea4de61b", "value": "T110157BE2D64058D4F86B66B85A776D37016BFFBDA868510D645DB132AFB33832032D0B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658381704, "uuid": "157db224-8273-4c05-9cc6-3dc7fb22b472", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658381704, "uuid": "c73a95de-58d6-4b74-9d80-7e8440157911", "value": "12288:xMLh2CBosh7jqE+R7j+VGRoEfGUipbOMtE0+PpYsi/IyGtpp0evrkrzv:xMLhYs5uXhKh0ipSMEPw/pG5DTkrz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658381704, "uuid": "c1fba6ba-a6e4-4f2d-a94e-25d620844645", "value": 898048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658381704, "uuid": "15cdddb9-07a9-4f02-9dc4-510225b032bf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658381704, "uuid": "1676329f-5726-4877-9394-62bb95cf6a8a", "value": "SecuriteInfo.com.Variant.Tedy.171259.18753.21520", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f7d7b6d-08c8-11ed-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1658389274, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658389274, "uuid": "c4078a8f-346c-4f6a-b2d9-82a4d0075696", "comment": "Malware payload (AgentTesla)", "value": "27332e0b8b55d04d457e58836b162f0c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658389274, "uuid": "90103ad5-4dc0-449e-81b0-92bcaf67c1b7", "comment": "Malware payload (AgentTesla)", "value": "878e4f9d7fbb5741f05437edb40db01d7884d6c61ce18c169747d5babd25f9d1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658389274, "uuid": "4ef13fc2-535e-4389-bcb6-620d4bee4ec5", "comment": "Malware payload (AgentTesla)", "value": "b513c46494fdfdf75ceddf36b515fe869b129714", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658389274, "uuid": "ffa47f91-2fa7-43aa-b31e-69f5f0f57f07", "comment": "Malware payload (AgentTesla)", "value": "b4b79f32880c3526b681e6e1d29b957af0749fab90511d1a99d863443225619a52d331b1742d054c799465e6dfbe64e4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658389274, "uuid": "def18542-febc-42dc-8f5f-c19ec903b3bb", "value": "T19CF4332B7492E6BF738B17247F460F6E86D628A3CE015095277F8CEB385741C18A9747", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658389274, "uuid": "5c375874-7899-4e2a-9330-82d525c21233", "value": "12288:hQdnljCxDZJegPvmVpy95lqQx2Qwv9u2L0bcVBltcmkHq1a42pReix9z8k:AjCxDZJFdrqe2fsczvh2q1ssixuk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658389274, "uuid": "fa8ad7d5-8a4b-4344-b690-fb3f2ae77f6e", "value": 765071, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658389274, "uuid": "5ec85cb2-3800-47bf-b960-ea168277a164", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658389274, "uuid": "316e3be8-fad1-4f7e-8289-bfc7361e4cba", "value": "New Order 3067729.z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91f135c8-08b9-11ed-93bb-42010a9c0043", "comment": "Malware payload (ZLoader)", "timestamp": 1658382862, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658382862, "uuid": "c65e0714-e5e3-4215-bcb0-2fed3240095e", "comment": "Malware payload (ZLoader)", "value": "809ec8b9cc10b2348578ad69779f3d0b", "object_relation": "md5", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false }, { "name": "ZLoader", "colour": "#95DA90", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658382862, "uuid": "b41bcf40-a209-4552-a40b-f02f10470f01", "comment": "Malware payload (ZLoader)", "value": "87aef5406dbda03a138f1e239db619d949eba9cca546da5956bf3d7ae2652677", "object_relation": "sha256", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false }, { "name": "ZLoader", "colour": "#95DA90", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658382862, "uuid": "77bd1f0a-56d5-4fe8-ba38-556edbadd5ae", "comment": "Malware payload (ZLoader)", "value": "d6c522ab1e635fac17331c62eb1bc338dbcb4091", "object_relation": "sha1", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false }, { "name": "ZLoader", "colour": "#95DA90", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658382862, "uuid": "9ac64e52-9f30-4ff8-b728-a02d42de6a89", "comment": "Malware payload (ZLoader)", "value": "995adfc4a782d5b31da4df71b3e6c9051a3ea8353928f4dffdc4872a1e9072b2b29562f1f549a5042463605badb5128e", "object_relation": "sha3-384", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false }, { "name": "ZLoader", "colour": "#95DA90", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658382862, "uuid": "6b36a19a-30a0-4265-9137-a8ea296bb0c9", "value": "T16EF3C683B70D9CE5E5A48278DF938EE05E17BC0CB6451EEB22503E1A7972CB16BF1194", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658382862, "uuid": "02bc44ca-1c14-4151-8180-e9f99a8b26e9", "value": "3072:C1k3hbdlylKsgqopeJBWhZFGkE+cLax9ZBmVqTEEk5JfF5PzRBU16g0sY:kk3hbdlylKsgqopeJBWhZFVE+Wax9wqc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658382862, "uuid": "fd2d31e6-7c62-438b-b98b-23a840edd860", "value": 168960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658382862, "uuid": "aa626d61-b0d8-4175-a5c8-0b6719819d52", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658382862, "uuid": "f2486c9b-b90d-428a-b243-c3fa9e8aa50b", "value": "Invoice 147.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5454be88-08c6-11ed-93bb-42010a9c0043", "comment": "Malware payload (XFilesStealer)", "timestamp": 1658388342, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658388342, "uuid": "e96b9583-20e9-48bb-b1b9-d6aaa5811926", "comment": "Malware payload (XFilesStealer)", "value": "ddfada98b1919f014d75f81640c3b08c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XFilesStealer", "colour": "#D1E15B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658388342, "uuid": "1525284a-55cb-4295-a60b-54fab25903be", "comment": "Malware payload (XFilesStealer)", "value": "895fd530b80f65be9942d8961c7ea58a289b220bdb21a011a741c65a3f8e6784", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XFilesStealer", "colour": "#D1E15B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658388342, "uuid": "88d3be63-c487-4022-8dc9-565ae0017e05", "comment": "Malware payload (XFilesStealer)", "value": "bb790086ad41fb39996e820d9776486a63ffd039", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XFilesStealer", "colour": "#D1E15B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658388342, "uuid": "44d308ca-13b0-4bc7-8df7-ac593e469d2f", "comment": "Malware payload (XFilesStealer)", "value": "aeff8996a5cecb18d75796756643ed66e2d29afaf74049ee9e221bdbe7184f7390ac2e78b06147c5f105dff5eeeaf272", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XFilesStealer", "colour": "#D1E15B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658388342, "uuid": "aa867ff9-c1a0-4681-a499-9245e3036860", "value": "T18C5612092F62CC17C2725B7849E6E33952B48F903D56D713A9E5BC6B7EB8B883D042C5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658388342, "uuid": "1bfa7102-4e85-4aa0-8b3b-e6897f66c26d", "value": "98304:dFfiz41iA2DZTNOhf82CK3KNwmam1+OM/Ir7O2l2AGWS1c/fZdc4AYauOGwl6S:dF0/A2DSh0pjNwM+X/2aSYaBdc4AYNVJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658388342, "uuid": "618dea82-9a81-46d1-ba04-4f26f55ed404", "value": 6260224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658388342, "uuid": "1e46c60f-9d61-42fb-82e9-177a2cea4b8a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658388342, "uuid": "1f6d6800-66dc-4438-a7f4-e2a0ee8c5555", "value": "ddfada98b1919f014d75f81640c3b08c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9bc5b96-08de-11ed-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1658398794, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658398794, "uuid": "1c6cc755-ddea-414f-b90d-44d0c0ca6c7d", "comment": "Malware payload (AgentTesla)", "value": "9c7d31e0f86c71f9cd6e39cf25bf5774", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658398794, "uuid": "89b25302-3ff1-4d78-81f4-10518e3a8e15", "comment": "Malware payload (AgentTesla)", "value": "8973819373ac79e5b891e3e019c69645442bf01463b07c84e647b46b607f6755", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658398794, "uuid": "42fe1ab9-b9d4-420e-9c04-8adf8f4f3523", "comment": "Malware payload (AgentTesla)", "value": "9c19dd5f6eae04b64e14fbb111774acd20864b99", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658398794, "uuid": "be8e859e-3074-4325-ad0b-7be93f307e2b", "comment": "Malware payload (AgentTesla)", "value": "0cd91188495b4134466aeb856f0c1f420e0122c2b161b134e6c0cdf685eb853783d233aa3288a9880b20052a370482d0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658398794, "uuid": "502ec399-a61d-4706-9eed-f8ae91e7880a", "value": "T1EB05BF18BACD116EC68E1CF1D3A18754A92563FB14DACA0E8BC927914E5F78303D99CF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658398794, "uuid": "59f4036b-8de9-4a4d-9106-c2fa1f03030c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658398794, "uuid": "ed79d492-e6ea-4f3a-8b5a-7f123dd57629", "value": "24576:dCSMU2+B89YyPbqSLO0Cpgin9G6ZK4lcEZtxof:dCe2+aiUbCiin9G6dyex", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658398794, "uuid": "18cf6517-ca81-42f3-a785-154334aca8a7", "value": 858112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658398794, "uuid": "170854b2-b10f-48ea-8de8-8523d511fecd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658398794, "uuid": "1445247c-338a-484c-bd6a-f67df5eab50b", "value": "Crypted alb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a781c117-08ec-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1658404803, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658404803, "uuid": "a98b8288-794b-4bd5-9038-79effae23006", "comment": "Malware payload (Mirai)", "value": "1dcb703bada4f5dc6921d94198614999", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658404803, "uuid": "320fd023-884e-415d-a58c-9f1e694af129", "comment": "Malware payload (Mirai)", "value": "8a7a819ec8be3d127303b8eef1f0b0c6b12ab505cf8531ed4eab4368c50e4ca5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658404803, "uuid": "a143ab70-18ba-40bc-8857-82cf7461d86c", "comment": "Malware payload (Mirai)", "value": "65b1823a2d5b7712427cdf3d927faa15b5c27a18", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658404803, "uuid": "25642dc7-da6f-409e-8b21-ae17ea4176ae", "comment": "Malware payload (Mirai)", "value": "7a216e0e098f5e1d2ca87571d2d96e86b1fa848c7f5a031d924a0962355c1b8f929d48d06494e8fcc0e7a51107f4df89", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658404803, "uuid": "8fd7f196-05f7-4dfd-9088-f5065756e759", "value": "T1B233CEB24EA7C04BD50166A2496F8D43F4E1C4D212B509C6E3C1B3FB8DEA25341E3AB7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658404803, "uuid": "e63629cb-4496-4883-928a-d7ad454d9c64", "value": "1536:3DIbC8P3P25J3Bg/ge4uQxaL6RRXw2jmO/w09ZJ:cbR/s3a/3kxaL6P3jwmj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658404803, "uuid": "bb07a184-aa27-4e05-a57e-619e6fc12342", "value": 54112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658404803, "uuid": "5e9897d3-66cd-4b37-a65f-defe177e17b0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658404803, "uuid": "5f39af32-b4e8-47a2-bc71-c636ca3833de", "value": "SecuriteInfo.com.Linux.Siggen.9999.8140.7843", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0bfb4ad7-08f0-11ed-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1658406260, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658406260, "uuid": "a69739b6-ee8b-42d8-9177-1b41ebe3dba6", "comment": "Malware payload (Formbook)", "value": "efe0e8d147563d3a43b13b2cebc3fcfa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658406260, "uuid": "810e3486-59f7-4877-8078-61bbc36067a0", "comment": "Malware payload (Formbook)", "value": "8ae33ce84b542cb3f81c7ea4f191891e2982c11e7ee52fecf519fe1fc9ea4ed4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658406260, "uuid": "bbd98308-663b-4e7c-8c74-fae75af5f70b", "comment": "Malware payload (Formbook)", "value": "d6dd9b81d7c887812ff022ad0b1da14cb9a7d1b6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658406260, "uuid": "d1fb7f58-0fca-469c-93f9-6777569da43b", "comment": "Malware payload (Formbook)", "value": "9ed49fe959d73744f9665f7a6130f4236a2e16d1696e831e3a69d074b92ab066412c644fd6711b2a2d791bf5ae29c0fe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658406260, "uuid": "a4e6c9ca-b66f-4531-a7ab-650c85a04f9c", "value": "T14ED4E01172BCAF92D9BD87FD1865908503F6275FA22DE3590DD3B0DB2A7AF500A50E0B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658406260, "uuid": "9a48ab1e-b5fe-40dd-bbf5-c70c9b725f5f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658406260, "uuid": "3f068871-341f-4f64-a4a7-574897f82b06", "value": "12288:vp831hXzSGtatBh7STUiM1dMzx0vi7Q07xv:xQX+ntrSTU5B6Vv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658406260, "uuid": "56122063-a9a2-4b89-a7b3-c8dd4c2a2daa", "value": 625664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658406260, "uuid": "c9f2a553-fda8-405b-8d0a-7b6f15ffb8e6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658406260, "uuid": "8fa80e66-f55c-4245-9108-59915a3a3839", "value": "Ziraat Bankasi Swift Mesaji.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a50be38-08b1-11ed-93bb-42010a9c0043", "comment": "Malware payload (GuLoader)", "timestamp": 1658379306, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658379306, "uuid": "65b1384a-2d68-4244-8e80-0459a875e8b7", "comment": "Malware payload (GuLoader)", "value": "f3d8b768cb3abeae4fdd7ea624aebf20", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658379306, "uuid": "7976e4c1-ec83-4159-af26-d4b418beb8d1", "comment": "Malware payload (GuLoader)", "value": "8b7ed31e9bd885a35675b7742d4653da32db8bf51e4bf8ccfefbe2c7b5121415", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658379306, "uuid": "0b668cd6-3ba1-4421-9f69-a72af59ef092", "comment": "Malware payload (GuLoader)", "value": "2aebd907560ebb6c499bb33d26c349b64bc5e6a0", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658379306, "uuid": "6a8968ff-bda0-479d-8b7b-bc81ce5156d0", "comment": "Malware payload (GuLoader)", "value": "41df0d775ecd1847dc41d74c2f05b6f7b6350b21b4a6e5a8bb0656fb8ad484a74b971858906b5a958f7bbb0a55640772", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658379306, "uuid": "a17974b3-e57e-4a3d-a863-2898b9db81c4", "value": "T154F42335FFAAB8F5E84B7B3AC37F15A9E8BC1820B087F9C0B059C0717565D99110A789", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658379306, "uuid": "a6e8be95-e01c-482b-a6d6-65b87ff6208a", "value": "12288:+88/3XmZO7GoP/pBYPyARSCgU0JOLsHimtcvSno7Q7CwNHLjzmy0sdXq9/:k/3XmSn/kyA0CRctiLgrFZjz11dG/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658379306, "uuid": "7b582ca5-faf6-44a6-860a-d34c18ea4e20", "value": 725901, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658379306, "uuid": "13485602-f778-4d24-a652-0f76b4c664b1", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658379306, "uuid": "d0414bc6-c9e1-451f-b0c9-b01be64f4c0a", "value": "PRUEBA+DE+PAGO.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef0c2a8c-08f4-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1658408359, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658408359, "uuid": "ef70ce70-054d-45e0-af69-5af60ddacb3a", "comment": "Malware payload (Mirai)", "value": "0ed10dc24512b084bdc8adf84c55a0e9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658408359, "uuid": "17b0f8fa-b9f3-485b-ba86-62f001accd38", "comment": "Malware payload (Mirai)", "value": "8bb900ee2ec7e2f9e3911c55a0342e0ecc1fbff7032a93254b6c9b6619cda50d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658408359, "uuid": "441f3c34-b5f9-4618-8709-c136f7237286", "comment": "Malware payload (Mirai)", "value": "365864166bd8c90a4696ae86b3f14f51486cab93", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658408359, "uuid": "441bf1c8-c57b-49e3-b728-60d589448e00", "comment": "Malware payload (Mirai)", "value": "69263868d44e352b1dd5d0aca223a783e563d85af4f5f7bbc2471db1a041cb309674ff5d153e1d9c22f30515a80db540", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658408359, "uuid": "fe29fe7c-5734-471f-a7a9-f44cce619604", "value": "T1CD533ADBB8019E7DFC5FE6BA54120A0DF62163A095530F27A3ABFCD7AD320985E12D41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658408359, "uuid": "e7b85d01-7bf5-40b0-8a30-7ffe0e9450c8", "value": "1536:C3Q33ZW3bLUxoTzZ7/dN40vgvwvVGKADG+8fik:CMk3bLUxopbdN4aATKYGvik", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658408359, "uuid": "35a1cb37-dc9b-472b-bfdb-a921116618de", "value": 64684, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658408359, "uuid": "0475c5a0-6e43-48e1-99ff-3f487a278b25", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658408359, "uuid": "86a7627c-69c3-434f-804a-b742181edf89", "value": "0ed10dc24512b084bdc8adf84c55a0e9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "873e65bc-08ae-11ed-93bb-42010a9c0043", "comment": "Malware payload (RemcosRAT)", "timestamp": 1658378120, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658378120, "uuid": "e4c8fb47-f190-4bba-a198-8bb5dfd09bc7", "comment": "Malware payload (RemcosRAT)", "value": "21d9a140fb94572d27eec0e394d9720a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658378120, "uuid": "d3b5da4d-663f-456e-b579-1a0f17188cac", "comment": "Malware payload (RemcosRAT)", "value": "8d8091a9feae64d126b51f3679a838572ea9578dad2255c329c769922025160b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658378120, "uuid": "244d94b6-834c-4550-8ce5-2e22a8c3264d", "comment": "Malware payload (RemcosRAT)", "value": "385825fa5050290e0e9d5ba0fcd5fe6bfce9e8c8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658378120, "uuid": "04e62b08-2d62-4ca9-be1b-2aa2126bc742", "comment": "Malware payload (RemcosRAT)", "value": "1b13265261fe00609cdc65c620fde4634e6b901806d713c37e3fa7ed2e1f912df733e77d61a2edf9de06ce9eeddc81fe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658378120, "uuid": "d0698a49-bc08-4355-852f-e87979fda56e", "value": "T165158E26F2A5CC33D062167E4D1A72B59C2E7F113E28F98627E53D486FF868075282D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658378120, "uuid": "6e8476f9-30a5-43d3-8afc-1160c96843d2", "value": "d516d5168ad28c9c6268d5dbd555a673", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658378120, "uuid": "82bc8055-fe6f-43cb-a566-8d1504901492", "value": "24576:3l5YzsDC+AbbRovDGw3Ny4EYysaxtVSn52pAf2rDNtl2aCHX:3rGJ3bNSn52KN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658378120, "uuid": "848f7091-8f34-4180-a64c-7dd90791fffe", "value": 920576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658378120, "uuid": "b6bcaee8-4b32-41a3-aff0-d5bb76e29f3c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658378120, "uuid": "d365fbbe-0069-4a55-b14f-b56f4b1b2591", "value": "SecuriteInfo.com.W32.AIDetect.malware2.4607.17104", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f50ee60-08df-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1658399179, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658399179, "uuid": "ddf78986-aaf8-4d66-908f-cfc5f5dd8c2c", "comment": "Malware payload (Mirai)", "value": "aaf90df5341a95783e2207d6404620e6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658399179, "uuid": "7efda8c7-a370-4757-b3d8-12ecd068cf42", "comment": "Malware payload (Mirai)", "value": "8e892eef9359f9112f6b6157822161bdb01cd3fe40e61582b8992a9c6ee5f37b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658399179, "uuid": "3846255e-5558-4e61-b576-e5dd9b5b453d", "comment": "Malware payload (Mirai)", "value": "283d3261b9f2b20a6746cf6e6843d2eb400290a5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658399179, "uuid": "721670b2-a3b2-4cc5-8a8b-fc7b091714a3", "comment": "Malware payload (Mirai)", "value": "60d2bf1def07ed9537ca4e3cf2e6abfa069cb94be696e9d7198df5078b66197b77da1ae64276a4dec0c45f13e31b8616", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658399179, "uuid": "230f9fe9-afc2-411a-b171-5c2d92f8efec", "value": "T136E2F926F881562BC1D1137AB6AE5A4D3730A3D893CF762B9D214B617AD612F0C67F80", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658399179, "uuid": "554aa437-40e5-44d7-871c-e4a5131893b5", "value": "768:2NdTmwmzd9va8rfwpU30ugzlOUPQFReqTbLLwT:7DzLdfwC30BQFRVTboT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658399179, "uuid": "bc65c3a7-acc6-4b00-b666-5bb9e1b438a2", "value": 31396, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658399179, "uuid": "1512e75a-034e-494a-82d3-efaf79d6c2fb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658399179, "uuid": "beadd9b6-a713-4be0-a50b-55f7faef8b7d", "value": "aaf90df5341a95783e2207d6404620e6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c00eab40-08f4-11ed-93bb-42010a9c0043", "comment": "Malware payload (AZORult)", "timestamp": 1658408280, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658408280, "uuid": "98dcc5c2-4332-42f5-9904-3ea25743a86e", "comment": "Malware payload (AZORult)", "value": "9d32a6ca7320162116260e7150349319", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658408280, "uuid": "f49bfb4e-2b02-44f2-bc4f-9bb460d4d1fa", "comment": "Malware payload (AZORult)", "value": "8ebca92cff949147d2dc62e0848458e51dba3063d18e370fe6ec5f6e985b7565", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658408280, "uuid": "bfb71fb6-5bdc-4189-af21-7927b3b1d1b6", "comment": "Malware payload (AZORult)", "value": "3b6bb9b1cd6cb5b08bfc5258ee2958def8df0da9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658408280, "uuid": "a4dc7e34-af54-47f3-bed9-92b26c6b5695", "comment": "Malware payload (AZORult)", "value": "881122636e51fadb6aba6f12c556dace1012cf7882d66d296beafdec478ba379b53c0f0d5e9000aacf61cf642e4e2b3a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658408280, "uuid": "cb5dd855-a258-4e8c-85cd-11c0622a2fb2", "value": "T1F6C4F13331F7D911C63843B284E312880BB2A20E7573E65F34DFA56686D27DA5A817E7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658408280, "uuid": "12295b16-17b7-4eee-a61a-be461f6575ea", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658408280, "uuid": "827029ab-3cf6-4196-815c-1a88bf6ba6f0", "value": "12288:x4Sogg31hex854G11Exu0feDwaU5luPTejm:mexVtu0m6uPTB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658408280, "uuid": "1347730e-7333-4d15-9556-3cdd34d90208", "value": 549376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658408280, "uuid": "e1873f5f-5d23-4639-94d4-53d3ba714c40", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658408280, "uuid": "acbc41a1-5850-4af9-9242-e301aebb2f2e", "value": "9d32a6ca7320162116260e7150349319", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ff4c4cf-08a9-11ed-93bb-42010a9c0043", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1658375826, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658375826, "uuid": "84418c8a-8692-4f73-a7a4-3a46bb574bf3", "comment": "Malware payload (SnakeKeylogger)", "value": "81f3e768058b4af39cee5af80ff91215", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658375826, "uuid": "9ace87ef-ba12-4d9b-bc75-b8b2bde53729", "comment": "Malware payload (SnakeKeylogger)", "value": "905d818616f511420c41ece2186350b7bb82c452665728b85c0d3aac2f4f9eae", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658375826, "uuid": "21866df9-623c-47f8-8c34-eda4d3496d63", "comment": "Malware payload (SnakeKeylogger)", "value": "a22bfbf7a1d5234cddbe78cab1ee6a9be6408ff4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658375826, "uuid": "9ca52801-2b10-4651-9077-8f9e12b1a89a", "comment": "Malware payload (SnakeKeylogger)", "value": "83a5ece9e1739b9b5aa3b17e29a0a01cbf82229aaf729ef305471fc8782e20c457dc507b82df8d0917b1c5d924a4b08c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658375826, "uuid": "395e42cd-5128-4bd2-bad6-92ed5d2f4717", "value": "T10F44023496CCAA73CEFD1BB11C7976C003A72ABB5B06F3C94A43B5C7264171894B4A97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658375826, "uuid": "d9e1ef1d-2671-480f-a552-c828ecea40ea", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658375826, "uuid": "2608a819-2af2-4db0-abe7-fca380d4ff7b", "value": "6144:0iYwlSSxmJpus8oxR7KQvIHaOu0RvMMd7D+XYW:0ixSSSgsL71Ot1MMd7DlW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658375826, "uuid": "160d365a-5d78-4f5a-86d7-6c22f630ce8e", "value": 269824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658375826, "uuid": "935a15f0-b294-4d62-92dc-7057fedea191", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658375826, "uuid": "2a53c370-30a8-4e4c-9712-a9bee958466a", "value": "SOA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c090c2e5-090a-11ed-93bb-42010a9c0043", "comment": "Malware payload (NanoCore)", "timestamp": 1658417730, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658417730, "uuid": "e5d7d088-23bd-44c7-85de-608a04bb87eb", "comment": "Malware payload (NanoCore)", "value": "fa70550a455ffc5650898ffae8804950", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658417730, "uuid": "95916b94-a680-4c96-8304-cca98dca1578", "comment": "Malware payload (NanoCore)", "value": "9062ad9019224f0ec0bf6521c3100894604af55ff0124a53edf46224907823f8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658417730, "uuid": "9f64915c-a3a7-4817-b251-65a73b2cc3a4", "comment": "Malware payload (NanoCore)", "value": "29dd733d1c8bb6ecec35a99f7be144ea59cd79f8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658417730, "uuid": "294b2d67-ef13-4594-8621-dd0102a426e6", "comment": "Malware payload (NanoCore)", "value": "98d965111f62db787d00487020621b02ddd3dcf4e3623aa7805915da76ca2eed0f79dc71823f53cb646e8bf43e609f20", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658417730, "uuid": "98605c25-7d61-40d9-8746-86b2c4a61176", "value": "T1492533B1352ADB97EF5EE7BFB5A19241237353589257C31EB6E2E00431513020E6BEE1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658417730, "uuid": "088d609d-311a-434f-814f-47a326bfe49b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658417730, "uuid": "65eedd59-084b-470d-bf96-59bfb5e84846", "value": "12288:lm1gez+d+rdEi9YjUMw4fs+RqCDuklMT4a0aIxEEVMcRSmtju4wtFuVv4Os:uFz+4dEvjdwd+HbltaIIcYmt64AGQOs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658417730, "uuid": "de68265b-2258-4e54-9f6b-ef75eb241529", "value": 1006592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658417730, "uuid": "982d7afa-69bd-48f8-9f87-e75f95a02daf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658417730, "uuid": "25a3b32b-3a75-485d-b322-3b501ba62189", "value": "fa70550a455ffc5650898ffae8804950.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fefc82f2-088c-11ed-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1658363718, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658363718, "uuid": "23facc46-40eb-4347-9b17-9ee22d4f5855", "comment": "Malware payload (AgentTesla)", "value": "186392207de6d83db2da32dc3c8bbf28", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658363718, "uuid": "ada2e101-8949-4ea6-a9f0-e0e8c1f8814f", "comment": "Malware payload (AgentTesla)", "value": "90f2a9ab67dd7f19fef97da8096cee3c68552adeaafbf00d4095a8ebbdc19e61", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658363718, "uuid": "3a61fbc1-5f7c-4071-b77c-bd06131a44d3", "comment": "Malware payload (AgentTesla)", "value": "2ae5f1e54e189feddd883420cbace44a1cb79b83", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658363718, "uuid": "6132f893-f363-4a39-8bc7-d9a6ad49db4b", "comment": "Malware payload (AgentTesla)", "value": "a550e2a43df31c4c9cfa26135cd8bec58d8bc44c06a36eb5cd6f60b9dbb7ad91eb986ebea988f9d5ac67d7872fbdbcc5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658363718, "uuid": "16fa3a7f-21ab-44c2-8df0-abcb812ff067", "value": "T1ABE4F260DAC489A0C25F633D30BA4D8B6675B982D417FF5C62602AFE93433518B2DF97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658363718, "uuid": "eb99e8d4-fd75-47fb-9158-41d0b81e0708", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658363718, "uuid": "5a7f8d88-1dd6-4890-bb6a-8bff88ea3c0d", "value": "12288:NRQiMcSvR9a5COHNpR0Vno/G8Zw2ubmN1XHbybmBJSaj1bKF:vga5RNpRzG8SHq3bybmBsaAF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658363718, "uuid": "586cd899-9309-4714-a5e6-5256fd06c8af", "value": 712528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658363718, "uuid": "ee7a5033-b478-4127-bdfc-69492bc6fdaa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658363718, "uuid": "65611974-b82b-4718-bbd9-1eaf88b9ab5f", "value": "SecuriteInfo.com.Variant.Tedy.132272.26608.30894", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8991ba73-08e2-11ed-93bb-42010a9c0043", "comment": "Malware payload (RemcosRAT)", "timestamp": 1658400458, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658400458, "uuid": "c88f47f1-c351-4c02-8944-dbf4a03984b0", "comment": "Malware payload (RemcosRAT)", "value": "f7a2daac6bba0885db7583822d2b4f4b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658400458, "uuid": "c15f64c5-23d1-4663-ad8d-50a1a8221ecc", "comment": "Malware payload (RemcosRAT)", "value": "910d9b435b172c50ad6cde23d820b4e1f07197e82ecdece15a74fbe750584378", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658400458, "uuid": "6047deff-1270-4bfc-a587-d641b5573c5b", "comment": "Malware payload (RemcosRAT)", "value": "c6402815348e2a3feb22c028ca64df7843b25145", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658400458, "uuid": "4137f1ea-4c39-444b-a856-5344ca1189e2", "comment": "Malware payload (RemcosRAT)", "value": "37a7ff9fffefcae3e44cada42765042f95be749b76f0fbacf219a17b7235c7ef5e16b1be58a2dd143c70e447ba25abc5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658400458, "uuid": "931a2440-836b-469d-bf28-bc7f2a229610", "value": "T10612E72177EC8739C9B60B712CB393804675FB26A923DB6E7485400E8D427888ED3762", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658400458, "uuid": "01c2c684-3fc1-4798-b6cd-a7c71e381563", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658400458, "uuid": "d1946cc8-b73a-4216-8b58-7d34160fc0c2", "value": "192:oQx3+dLDgRnIQFCPDJCeCLYtSY2+1ednBArQI:NcdLDgRnjYJC7YzQdnBArQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658400458, "uuid": "7fe665cd-803b-4de3-900c-580aa2043cf0", "value": 9216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658400458, "uuid": "c354c17c-9104-48b3-865a-cc3a48f80faf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658400458, "uuid": "b5ac3a38-d2ef-4c4c-8a3e-d2abfd40be8b", "value": "Proforma Invoice july22.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6449475e-08c6-11ed-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1658388369, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658388369, "uuid": "849978f8-fd68-40d3-9e15-2f020649a66c", "comment": "Malware payload (AgentTesla)", "value": "115daf6334dce3fbf782ff45f01bf806", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658388369, "uuid": "ca837f90-72bb-4e07-8b5b-7376dc4e7c19", "comment": "Malware payload (AgentTesla)", "value": "91959e649c4d7159d4350ddc7985b56ec970dc713f4f22ca7a15d463be64b9dc", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658388369, "uuid": "795e4047-74fc-4f43-9837-c9546a334ac8", "comment": "Malware payload (AgentTesla)", "value": "2e9fa6a168fda4e3d18defe85558a3442b95f129", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658388369, "uuid": "d2a82e1f-aad3-424e-9f76-94fabb661ef6", "comment": "Malware payload (AgentTesla)", "value": "d9080c6dc66c062f67528834d63d2548ddb7c9f7d6b59523899b00492dc6446e0c25f1fd51737d8669fdabd1f4beb653", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658388369, "uuid": "2aa9f1ca-6bba-428f-a8fb-48210a8c4d17", "value": "T1B6C4231FBF8A1E77B0D44ADF18B22CE5309BFEB9A66FC7591802B21515E848E46F1904", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658388369, "uuid": "8adec16a-2021-4d27-881b-a0eced440359", "value": "12288:iOhk2jdOqI7QGob+dwAMiYepjFdYolTbxqVMoS7cIJLzpO+vfdF:iO22jBOQGoSORep4ol8VMNpLVOkfdF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658388369, "uuid": "0d0e28f1-29f5-4677-bc76-104ab67c7c4f", "value": 596342, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658388369, "uuid": "9a2e1d75-0faf-476f-aea8-dacef6002246", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658388369, "uuid": "0702019e-1b77-43ab-86c6-9d0164dda041", "value": "DOCUMENTS.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52e84b15-0932-11ed-93bb-42010a9c0043", "comment": "Malware payload (Gafgyt)", "timestamp": 1658434726, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658434726, "uuid": "39a631f2-1bd8-4013-8a91-6eabda315cce", "comment": "Malware payload (Gafgyt)", "value": "773cd9711fc9f96fab96e9fda14ba2a2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658434726, "uuid": "939cdf87-ad3e-4a8e-8789-ddaa07973911", "comment": "Malware payload (Gafgyt)", "value": "91d5891cd2b467642759ff22950cec4d160f52c65cd49f964e3f34570edcd122", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658434726, "uuid": "b3699c60-679b-428f-8794-f9a2af39c1bd", "comment": "Malware payload (Gafgyt)", "value": "0e6a5be98b0cddf6c9896818e7efafda9891da43", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658434726, "uuid": "aadebb0b-1018-4a3f-93fe-6c809daabf0f", "comment": "Malware payload (Gafgyt)", "value": "58217345c038d5db162c7c97539310d4106b3e72e304fd0436b71de134e4044284aee0ac9ab91e5d065f60412c0efabf", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658434726, "uuid": "07f8282d-1a13-4c64-b54d-d7cadaf191e7", "value": "T139934C92F741C6B3D1831AB2129B9B110533F6BB1A4BAE16F36D7CF09E150857623F98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658434726, "uuid": "84fb84cb-0b4f-4364-bca8-68c6fa98e251", "value": "1536:eyIJdv/tUYUeG2WBiLfWXGJ2HLO3FrcLwo3mWzWWW/ykQVtXhmL+bVOP43XfppG:IdvFUYUeG2WELfWWJ2SVrEeTQfXhmKbe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658434726, "uuid": "f03b1dfb-b8b1-44b2-97d6-2c9ab7d09450", "value": 89429, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658434726, "uuid": "73ee8934-ae19-4bc8-97d9-75187ac5d4f2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658434726, "uuid": "6475ec15-859b-4625-9f36-14e8c452e3af", "value": "773cd9711fc9f96fab96e9fda14ba2a2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1405dd9-08ee-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1658405759, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658405759, "uuid": "81110d84-15e9-484e-8457-48bd2e9a5357", "comment": "Malware payload (Mirai)", "value": "7482523000ca6ad1564ec15cacd76f5d", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658405759, "uuid": "4f953ee3-6ee4-4ee4-9c33-aa90c71a5b2b", "comment": "Malware payload (Mirai)", "value": "92e4329e1b68b7ab52576c647d36ae1d1bfdbd165ad7856c9f77d3c217379085", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658405759, "uuid": "211abe36-c63c-458c-9574-cfba0ba49f98", "comment": "Malware payload (Mirai)", "value": "22d5d3509354fa3d92b02e70556799697f3bf1bc", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658405759, "uuid": "fd88c7ea-19e1-4dbb-9f26-377eeaa3b504", "comment": "Malware payload (Mirai)", "value": "f563ad9b9b99f15c4d4610274a7965c4415540ab6a549521a6031e7910004003771f3b31a7f588e7f8c04ff4f018622c", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658405759, "uuid": "65fc5ed9-d22b-4af5-9873-dd6b0adbb541", "value": "T1CA23E1ABC58B69B2CCB27CF5E0F208E753FE99E65198BA46305843CDCC51286527DD83", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658405759, "uuid": "09763818-0a6e-4ff2-8a9f-f1b2c0640f8b", "value": "768:27D9/kFIjZFID6PKtSeW9/5VHAv+bgmlmdq3UINMUO/GbAedENwtYOBy:2Ptli09RVHAv+8mlBNMhPeSNpOy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658405759, "uuid": "c7c44929-3774-4c78-8259-29ebc0e3ff35", "value": 50000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658405759, "uuid": "4b3b2c77-94fa-4b5b-9277-7b7e54fc9570", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658405759, "uuid": "a8c002cd-3a9f-4a47-97bf-d4e4e64a6613", "value": "yakuza.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c38c9237-090f-11ed-93bb-42010a9c0043", "comment": "Malware payload (RemcosRAT)", "timestamp": 1658419882, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658419882, "uuid": "3131cedf-f5b9-4e1c-95be-eddd460a313d", "comment": "Malware payload (RemcosRAT)", "value": "06f51e4de9bbb55197e7d1006833bef5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658419882, "uuid": "7df93028-6d3e-4220-a73b-b2997aefa9dd", "comment": "Malware payload (RemcosRAT)", "value": "93c44acd51b11807883d39e0a7ca13a178f0c69e9b7f20e90245c5973c937db0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658419882, "uuid": "a3f31b45-3ed8-4b94-91fb-7e03cb416b40", "comment": "Malware payload (RemcosRAT)", "value": "d2eaa50b35bdbc42c31844e3125cbd1bc2c6a960", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658419882, "uuid": "3face41b-2bf8-4522-b2d6-7ed841198178", "comment": "Malware payload (RemcosRAT)", "value": "a687dd71361c74c413ea0ec681d7ce546d35015dd29f54b8ec157c3d5d19b1d5ee65c735122442984243205316dfe1b7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658419882, "uuid": "ec7249db-12d6-446a-8cfa-789fa4dc9cec", "value": "T14605239423A0917ED96D47F110404219177AE3427A2BC34D3AE61AF95EFF7234A90BBF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658419882, "uuid": "287298d7-bf1f-452e-bade-d950c5fdf2a8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658419882, "uuid": "8bccf2fb-2f5a-4178-9303-a4b0256358f5", "value": "24576:2k55KdsGMVhLW0c9hubP6AdmZKX9wIoORy:2kdGMVhLHKaP6AIEC4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658419882, "uuid": "03ab29fe-35f3-4c34-a623-bacc5b9e1f49", "value": 818176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658419882, "uuid": "c44d1f51-6796-481c-a0dd-cc124c12610a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658419882, "uuid": "008a9b88-ecd1-47fc-b198-3cbe9590db79", "value": "06f51e4de9bbb55197e7d1006833bef5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9cc7b63-0925-11ed-93bb-42010a9c0043", "comment": "Malware payload (RedLineStealer)", "timestamp": 1658429422, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658429422, "uuid": "c70228f8-99a5-414a-b6aa-c99b0f318d47", "comment": "Malware payload (RedLineStealer)", "value": "f86cf85d6d81d6d190f06724c5c0e262", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658429422, "uuid": "3d70ba40-c156-4e63-8aec-6a908e20d732", "comment": "Malware payload (RedLineStealer)", "value": "943aa3bf984a6ddba2d83940286a27095761974676c78bd356ad6fe11eaad556", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658429422, "uuid": "52fdfe17-4ae8-4fdb-8b0f-f1fc4a0f0a7e", "comment": "Malware payload (RedLineStealer)", "value": "5487b38391824478da98b424a0fb207098678c5f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658429422, "uuid": "908e7078-d08d-473c-bcf4-835a552a0d52", "comment": "Malware payload (RedLineStealer)", "value": "2531cd9d4e0c83e4a91e65535264173536dd808fdb8b89b71282fae78e9115fc782b987d5505accf9ddfe533c876c2d4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658429422, "uuid": "b38dc656-1837-45f4-b4ad-303c7bd24594", "value": "T13F14CF1276D0DC72E5A3253018B0CAA1667AFC62973495CF77A43B7E2E317D02A76363", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658429422, "uuid": "2b95b574-c8a3-4b94-9dc7-a1a064f26d08", "value": "b87c62264ccceb96c52705a75b76beba", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658429422, "uuid": "9b1da808-452a-4fe8-b634-84af05a00167", "value": "3072:/zayNNYl5gLVw4uePCOqVi8qok8oY+j+GRwhyggqPG:/BNNY6iZO9R8oj+GRw0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658429422, "uuid": "dc316595-c9e5-4473-a61c-dded6b14c04d", "value": 191488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658429422, "uuid": "946a8493-4b1d-4ac0-98e6-a6a6f4d84608", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658429422, "uuid": "6d4202b5-51f1-4bbc-a326-9263e0918753", "value": "f86cf85d6d81d6d190f06724c5c0e262.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d40966d-08f0-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1658406343, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658406343, "uuid": "89790bbe-525d-4052-873e-bebe96a13775", "comment": "Malware payload", "value": "730768c4f029608adf0032e95e8e8a1d", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658406343, "uuid": "edf84a39-bb0e-4a4f-97ec-559f6374bb62", "comment": "Malware payload", "value": "94fabeeeffae82a107913815c2b62e4311aeef432197e0d2d6af40a7a65cd5f1", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658406343, "uuid": "886a8862-9615-4fce-8d3b-d6c25071c7bb", "comment": "Malware payload", "value": "c071befaa2d7548d53dfb0f1f611c6fd1b174f46", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658406343, "uuid": "554a2b9e-3460-4629-afc7-cb3b4878f79c", "comment": "Malware payload", "value": "42bcda2e86be5efb77998ad11781d4a9cd1f663adf3f5a4651a40e09d588433c6978f6105763dbc321291fd5ec0e0660", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658406343, "uuid": "88509185-9828-47d0-af81-f992081ec7a5", "value": "T129228D36802A5D30DAAAF774F0A45A56EC5C1482E7773DF9B016BEB389C22CE5274E40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658406343, "uuid": "65dd1c70-af75-468f-b70a-8088d7e86fd7", "value": "192:CEhMA1GheFb8c9264wpHV7Z/c+8poF1d3jvvtlFOrGxjPkfzUUy2G:Cq/1GAFbx92hwhcfa7pr1lFOyxjPkfz+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658406343, "uuid": "f34ec7c7-8eaf-41f2-b138-f0b363f2af4a", "value": 10734, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658406343, "uuid": "76c7aff8-8f5e-4b04-a590-232ae64dae78", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658406343, "uuid": "6d4f0d65-3417-4cbe-844e-b39ca8d5c18e", "value": "Court Fine.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8141347d-08be-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1658384982, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658384982, "uuid": "c34838d1-9904-4075-9c35-c69b108e6a67", "comment": "Malware payload", "value": "f9f7e4b734d555814439256a4550a9dd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658384982, "uuid": "42daefa8-98ec-4e11-b9e9-b57bd162cb2e", "comment": "Malware payload", "value": "97261fee3b80f8396ae8c4c2522d7613b69b41644e5c8e03948aedf6778c3e42", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658384982, "uuid": "945da6f8-8310-4d66-9d85-44c598cadae8", "comment": "Malware payload", "value": "110f36964c9ad34d35e7afeb48215764500d37cd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658384982, "uuid": "f8737c85-4c3f-43af-8fe9-33e1fbd63e0f", "comment": "Malware payload", "value": "94bdc24aeb77a2796bfc98b8422990c8376f9157d5e030f711fa2eaa28c4ced8e842b7b94d9d942bca758f1216a67803", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658384982, "uuid": "c31168c7-0f8c-4870-9cad-96a86f87a08f", "value": "T1796412E0CB71BD2AD54A1C3C4125CB6DB7F51B894A21C797B1118FEA78C9243A3F6C61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658384982, "uuid": "27036677-ca94-4534-8ec8-6f8d12468e2d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658384982, "uuid": "ecd5bda0-c03e-416f-ace1-fc78479f947d", "value": "6144:ZaA+l9nqPU0wLpfAWGWrF4pXkgJFF1kCsOPF/TbL8LahOlosA:ZJ+l9sUxpUiF4lksFmCr/TbLAaAlo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658384982, "uuid": "7a31527d-0d13-49ef-bca6-1d3dff0d79cb", "value": 313856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658384982, "uuid": "5cc11177-5399-4b37-8d69-397ac88d5d99", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658384982, "uuid": "f0690cd8-5707-4fd6-bc4d-fd8f8f0b6e79", "value": "f9f7e4b734d555814439256a4550a9dd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20747baa-0932-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1658434641, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658434641, "uuid": "3679a520-0f9a-4499-a2a7-0f9940828b04", "comment": "Malware payload", "value": "9b0e9e8b4ee381e860edbe3d059554b3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658434641, "uuid": "5843e5c8-8252-4d58-8b41-c2b0cc1e59c8", "comment": "Malware payload", "value": "98bd7de2ba7536299385e6f96106e5e20ef6d98950b1a6e66fd4fc5f6ce4412a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658434641, "uuid": "68e8293b-beb6-4f2a-85a7-789a5e11650c", "comment": "Malware payload", "value": "20d5941a45f2ea93a8ff2a37d60f88e2d1053f4d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658434641, "uuid": "12b3f9fa-aea7-4a81-8ba2-84358f6fd928", "comment": "Malware payload", "value": "4d00d2f953f48effb95136be267707e0824782c51d57d2f3e4af2a430a43fd14e941f0ed36f705a89afa507775cd80fd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658434641, "uuid": "933810ba-2031-488d-a336-84247dcfaaab", "value": "T1CA933B57E9628F73C0465AB225E75A300B53ED921B4F2A85713D9AF4474B4CEB80FFA0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658434641, "uuid": "15f5d417-9b33-4281-9e67-1bbdfb39a026", "value": "1536:QLTZ2+yHiiuWKhBj7R2i2ZSselDCBWWWZkF68Sm/nVqBovrf8yI:Q3aHiia/Ai2qD306Zm/nVqBKrf8yI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658434641, "uuid": "765e65a4-442a-43cb-8890-90edfeed41dd", "value": 95130, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658434641, "uuid": "597e2d1d-6e99-4250-a20b-5e8e675c7d95", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658434641, "uuid": "c4db720c-af59-4893-b74a-74870de93afc", "value": "9b0e9e8b4ee381e860edbe3d059554b3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73ede179-0922-11ed-93bb-42010a9c0043", "comment": "Malware payload (Loki)", "timestamp": 1658427909, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658427909, "uuid": "9c58e881-7375-4150-a2f6-78a9f447606d", "comment": "Malware payload (Loki)", "value": "bbb245d8efe8ff40cbb9044f092c50b2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658427909, "uuid": "d05a7685-bc82-48e4-b53e-d5eccf25fb66", "comment": "Malware payload (Loki)", "value": "98ec456017e7c302c59591abc9341632f197543cc177abcb9058d95697f07e71", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658427909, "uuid": "96ca4559-6785-40b6-9232-947c0e89eaac", "comment": "Malware payload (Loki)", "value": "9a17608b699be7a67cce86bca251db8685758d99", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658427909, "uuid": "9021c24f-70f8-4afb-9667-116c3aa8d1f4", "comment": "Malware payload (Loki)", "value": "76851fd7e51f2710d694c91738dc532322ad250e3ab2e04d278690e426f47dfe082fcc7973ba0a482b7b4cffad3f4f15", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658427909, "uuid": "d0bd48fb-465b-4a1e-ab53-cef1d62ae615", "value": "T169548D00BB90D435F4B712F44979826CBA2E7EA1976850CF62D52AFE57386E4EC3071B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658427909, "uuid": "349ef52d-2b12-4b4e-8134-ded23481b071", "value": "9923dd7e7c2f584bdf6e95cc5c2f9d7f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658427909, "uuid": "114f299f-6203-4fc6-957a-d154f7aa28ca", "value": "6144:3eDZV1JnTszi2ida70JrsaH3z7p9nmU+NSDYJC:uX1JQ22ak0Jrsaj7p9mU+NaY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658427909, "uuid": "733ccb90-914d-4ad9-9594-c262fc002ee3", "value": 296960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658427909, "uuid": "ecbf36f0-0a25-469f-a08f-b992b33c0bbe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658427909, "uuid": "63e74136-e9f2-432c-bf8b-082964067c58", "value": "bbb245d8efe8ff40cbb9044f092c50b2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0f9155d-08bd-11ed-93bb-42010a9c0043", "comment": "Malware payload (GuLoader)", "timestamp": 1658384606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658384606, "uuid": "3ae65ab6-776a-4d1b-ae97-d0f5868e126c", "comment": "Malware payload (GuLoader)", "value": "4665d77ded2dcd57301ad3a12ef29ccc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658384606, "uuid": "1f745ed1-b3ef-42d9-a63b-f71393343765", "comment": "Malware payload (GuLoader)", "value": "98f3769bc2318575d1a8d3964c11a6d14b4be9aa380395f9dc3e368cbb465056", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658384606, "uuid": "ac838875-4398-4822-9557-32db732edf20", "comment": "Malware payload (GuLoader)", "value": "287c13aa36c57c6c4f6d102a1437bff47b5d5408", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658384606, "uuid": "c7b336f9-91a6-4fff-815b-e7eb9017f0fa", "comment": "Malware payload (GuLoader)", "value": "7393defaa47e3ccdbf58b375e24662dd13e497ee3676599906849bc2ba3527e88a062cef4aea6ac64cd532eb65bf3169", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658384606, "uuid": "6e2fa439-2943-4aad-8747-6aa4b0d36334", "value": "T141549DA1D240889BEC6A03B6C837CD25156BBD7DA8B1661F666E71357BB33C30027D0B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658384606, "uuid": "a3bedef6-ef54-4c3f-a184-c770948d4777", "value": "5f0c714c36e6cc016b3a1f4bc86559e4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658384606, "uuid": "1fa3826e-b68e-4c50-8b46-3d480e384338", "value": "6144:7DfezhH/Sd9/2JJHEADnXBKd7lt6n9lBO:fRgkADxKd7DD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658384606, "uuid": "3afc7190-ffd0-446b-a8f4-8114b36e0778", "value": 292240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658384606, "uuid": "393238d2-7f0e-441c-b514-11f4c4192d7b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658384606, "uuid": "d62ee3b1-de49-40cc-b9be-04bae287cba5", "value": "Bileddet.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61b73d9f-08aa-11ed-93bb-42010a9c0043", "comment": "Malware payload (Vjw0rm)", "timestamp": 1658376339, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658376339, "uuid": "80bb6523-6ee9-49b2-90b2-d0fd37d0e207", "comment": "Malware payload (Vjw0rm)", "value": "83b651aee65370fbeb60b5c3c107f511", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658376339, "uuid": "baf02c58-6604-4080-b82e-c44c141c509d", "comment": "Malware payload (Vjw0rm)", "value": "9a0772ccf13ca7650e35bf626543250e6b4e1b5359f849c7e35515ca152bbd23", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658376339, "uuid": "2aa3d4d7-a7f6-4010-bf4d-12df9111b0a8", "comment": "Malware payload (Vjw0rm)", "value": "93d66991d1d1e5c0bcabd6e09bc11f178758575c", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658376339, "uuid": "9ae40034-61cf-41a9-876c-12eb00417a1a", "comment": "Malware payload (Vjw0rm)", "value": "bacf2f9fb430f830b74688fa922afb7b0b31a0e70ff74fe92936797be2bc77dd16ca93c814f1ccc5b81589a673455503", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658376339, "uuid": "50e45a9c-76a8-43a0-9514-3e277229dadb", "value": "T156729E89AE34AFB4CF7416844AADDE5D0FFC8E0F6810596D3632EA44B5F0908292F25D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658376339, "uuid": "63cd8745-e1b4-4dfa-890a-576bab6aa948", "value": "384:O2yWdzq6W2R8En8RBty/atjM8TLIVgKMlowfMo:IEqunofy/WLIVIowfMo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658376339, "uuid": "8d45c319-fa9a-4e3d-8afa-b75c0b85f9e9", "value": 16823, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658376339, "uuid": "d645741c-fa21-45ce-bdec-845ad8b1e917", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658376339, "uuid": "3a4a7d8c-202d-4946-8669-b1626bc6c03f", "value": "lsWmFUhNjQp0wer.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c85c6c7-0929-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1658430742, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658430742, "uuid": "93203621-6759-4710-b776-20989cbac8ca", "comment": "Malware payload (Mirai)", "value": "61618e14b9ffb6d5c322128903e8c283", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658430742, "uuid": "2f8522ba-5b68-4bfb-ad19-afc08a8fb754", "comment": "Malware payload (Mirai)", "value": "9be44bd70a4af8e99569809b2c6f2818a49d4852b8302b24aff8cb11027819ec", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658430742, "uuid": "f6f6dc7f-0fdd-42cc-ab62-078291d0cb8f", "comment": "Malware payload (Mirai)", "value": "7550374209dfbfcdf41936ec0a4079b5afdcd80a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658430742, "uuid": "46755387-d1f1-4e45-9312-ce168796e787", "comment": "Malware payload (Mirai)", "value": "17fb3f350b8f8eecfbabc6030c4f08901f1d68ec0b3d5a8802b74d7031f8b39710106d700d2f0652dce256019446fb33", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658430742, "uuid": "664af312-4248-45b8-8de3-7030de9da165", "value": "T14BD2E0B59FAA860EF4CA733C5DAEDC9A65AC7C601EBD465A02411E5231385D1F3DCCD0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658430742, "uuid": "19996d0a-bc27-4e8f-97e0-f0286735220a", "value": "768:fN8fWlfoQmQAXV7E/QciiRcLprDKAO8qc:1MNXFl76N4PdN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658430742, "uuid": "b975560e-21d3-420f-aae0-fcb999e085b5", "value": 29904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658430742, "uuid": "3685a527-1b7f-4d2c-b32e-d8e0f898b28d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658430742, "uuid": "40f9d618-2471-4637-8ddd-862a9d5b80fd", "value": "61618e14b9ffb6d5c322128903e8c283", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0853d71c-08ef-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1658405824, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658405824, "uuid": "703954d3-e4b7-40d9-8a51-4f49053a7d2b", "comment": "Malware payload", "value": "c3fa2042b55ee2fe3f1adc151ebd3eaa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658405824, "uuid": "eb216076-742b-4cf3-a1c6-692f400b6288", "comment": "Malware payload", "value": "9ef42dc9a9a7a44dbd2d9c9af11eedf2e370047425a897fd72d428fae61e3b35", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658405824, "uuid": "f7cc69cc-4c51-4253-89be-cc8644656c87", "comment": "Malware payload", "value": "fca10c4e142eeaf12b040e055db29645882ea9ab", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658405824, "uuid": "0702aeaa-43fa-4dbb-8782-e2b539b17bdf", "comment": "Malware payload", "value": "e9d385a25b4c9dc4ee291f83c5125bfcf2e2d791906bdd1bd6ac6efa5bc84f42147e6f6500bdca42c320c4452b5fc2ab", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658405824, "uuid": "00674cc9-db1a-440f-bbaf-c0fa0bd4e217", "value": "T1EEF46E2291C7D2F1F3F724B197D002BF5D289127C68A9D35F8252548A3861D6BC3DBEA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658405824, "uuid": "dd041c92-9a60-4a1d-8a83-7ce37006f6d1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658405824, "uuid": "20d5c231-fb1e-4014-a039-d9277942a0e7", "value": "768:5RdutBr/u3GduUrRTj8ObyVUBMfSDFTh0lrpcxNq3ey16HMV1Iu3MCBo6qstNpzJ:5R4HmK3Tj8J4FPHMV1tNRLbwCX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658405824, "uuid": "25c61373-4466-4af7-b794-6e3be2404856", "value": 725349, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658405824, "uuid": "32b6dd72-ea8b-4de8-a988-edd1efb6e419", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658405824, "uuid": "86a86962-a6c3-486c-ae2b-5053c661344d", "value": "c3fa2042b55ee2fe3f1adc151ebd3eaa.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33839a5f-08e9-11ed-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1658403320, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658403320, "uuid": "1bc26bf5-9aa9-48ec-a070-58af5977ceb6", "comment": "Malware payload (Formbook)", "value": "5c8b8e9691cdb1a51d97eccfd325159b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658403320, "uuid": "2e95c159-5e34-460b-87e6-2c58eb47d488", "comment": "Malware payload (Formbook)", "value": "9fad4236f797adede7588c51a5d90dc7df99cea0bc590adfa29eef48d652d905", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658403320, "uuid": "645f7935-32e2-4f91-b3d0-9d637fae9eae", "comment": "Malware payload (Formbook)", "value": "948250ffc348261bf6680937c9cd7eb8ab49e986", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658403320, "uuid": "92835bef-7e69-4560-aa4d-678664526bf5", "comment": "Malware payload (Formbook)", "value": "f16f82a94ed89897d69d07634aa0c08e2fb0e4ac6b22d01c450b92f2492605822538a34a94c0bd18376344878a162b63", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658403320, "uuid": "98d7d908-be68-48ae-bd87-67b2669e5a40", "value": "T179049E36EA02C070E2A241F5B27D1B7B843D1D3432A560A6F7E21A957EF05E5B42D72F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658403320, "uuid": "fc374477-1355-4b70-a0c4-be801656ac24", "value": "3072:n/k7pOO1fb66AqD+WGFF4xL8vV5NedYoP4StxnZ0LqB3dqqm7Hwu4:87pOO1DlAqDuF4x4vvNedYoP1Z0LS3dy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658403320, "uuid": "0d9f7d2f-a62b-4b8b-92f4-4915cc2f5f17", "value": 181248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658403320, "uuid": "82d705d7-9ff6-4bd7-9fc8-5dba82a17640", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658403320, "uuid": "85317db8-ac9f-4425-bd23-fa472c944988", "value": "5c8b8e9691cdb1a51d97eccfd325159b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c438bec3-0903-11ed-93bb-42010a9c0043", "comment": "Malware payload (njrat)", "timestamp": 1658414729, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658414729, "uuid": "7bf9637e-e946-449a-874c-4efd68fdb977", "comment": "Malware payload (njrat)", "value": "b67d1d74a0fd86b324de2fe45d64fc68", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658414729, "uuid": "5ebddd2f-47a0-416c-90a0-d32942cd356d", "comment": "Malware payload (njrat)", "value": "a086daaeb70db56ec7567bf19493cd2809e7a5756c0b0a05240b5bd8c48dd7d8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658414729, "uuid": "c80ef5fb-1398-47ae-8d1e-d4200033fcd9", "comment": "Malware payload (njrat)", "value": "5b2187a800b467c41b2a390fa8f539b18f0dc0af", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658414729, "uuid": "f97d21fa-cac8-408b-ba00-2f156359e0fb", "comment": "Malware payload (njrat)", "value": "bd049c9bc68be29a67bc98cbdb092e575e987c5af110c7838515e880b103f88f9d5ff7fb7c6525da0af392fb9dc52957", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658414729, "uuid": "81baeec0-829e-4ead-859d-ec3760fcf71f", "value": "T1BA73A7BC07FB118CE5AFD8B466414444F90F55D7888AE99892B3C4B50B2DABD392C2DF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658414729, "uuid": "13bd3278-4ea5-4319-a68a-86c18ac84aa8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658414729, "uuid": "1d6a41cf-adfb-4e14-a415-ff102112c958", "value": "1536:Hp3mNqF3+Iz7nf8i6e8RM24kyH7XfnaOegn:J2sFuIz7V8RM24tLfna0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658414729, "uuid": "25be61c4-95a5-49eb-9a97-4aac655128ba", "value": 78336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658414729, "uuid": "5428af50-9083-40f7-aa27-f9e904175f78", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658414729, "uuid": "b0075e12-88eb-4104-86b7-dd84da5cf0c8", "value": "b67d1d74a0fd86b324de2fe45d64fc68.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "602ca05c-08c4-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1658387503, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658387503, "uuid": "57b088c3-d3bb-488e-9cb1-8772b12ec613", "comment": "Malware payload (Mirai)", "value": "06332466dbe23dc0cac1b7fba23a4660", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658387503, "uuid": "900cbacb-0486-435c-b713-555e984330b2", "comment": "Malware payload (Mirai)", "value": "a1200e93ccf62ef466b16da4e02454d674d62e3c50986bfbfa6b2eda2146a21b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658387503, "uuid": "51d0e68c-f96c-4e60-8c7b-32514a0a3f3b", "comment": "Malware payload (Mirai)", "value": "d8b008f522744fe59fdcd8487392210abfb3c1a4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658387503, "uuid": "4521dc85-ca72-4d8f-bfb7-16be9e262337", "comment": "Malware payload (Mirai)", "value": "1c1386fde3dcb8f441cf8384d84573e80d05b9120fd041637ff678292aa3fb0c407131569ad9203a8301b55a9d1da2a5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658387503, "uuid": "d0978bf1-061f-49c8-913f-f408575b77ea", "value": "T1A8439D36CC7AADA4C4198634B0645B301763F518B6933FF61E878662A453EBCF2193F6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658387503, "uuid": "eaf9b7cb-6644-4cdc-8d07-0645ef1018f0", "value": "768:sac3CR0zie4qbe7egewe/c4sgnME+tOjsc5R3ZhBoFjY0ZtVC62wj81v:sac3CRsiBauZxtgEUjX5Zh2F7ZPC6vM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658387503, "uuid": "b3180337-dbcf-46eb-ab15-1e8bcab75653", "value": 56120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658387503, "uuid": "23e7e6e7-4fac-4289-9714-82c0ce55856d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658387503, "uuid": "9ac4ada1-1cf3-4788-b919-f773d29595ee", "value": "06332466dbe23dc0cac1b7fba23a4660", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b18eb03-08c6-11ed-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1658388381, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658388381, "uuid": "66abe2d8-11ec-400b-8f8c-9158576e1367", "comment": "Malware payload (AgentTesla)", "value": "cd4205842d36fe85c580bd4b14a04d4a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658388381, "uuid": "d9aee532-e4db-4032-88e4-3d09b7f82d15", "comment": "Malware payload (AgentTesla)", "value": "a2ba55fee33bd2cde64b4766707d7c53848003136871a4c8fd7072deb8e0d983", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658388381, "uuid": "d76a8d43-8a5e-4e0b-a2b5-ce29a1241d85", "comment": "Malware payload (AgentTesla)", "value": "fbf54ae0f50f55da9cc2cf7ce9358f867939d862", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658388381, "uuid": "feeed279-8a5c-4951-b060-923791742347", "comment": "Malware payload (AgentTesla)", "value": "8032d6f1cbe8767523e0f0d4f02459acb6e3a49fc9b3c5c7ac13417cff37f3b8cf57a00db79e347d4396b89f746c08b5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658388381, "uuid": "71faf8ae-f6b7-40eb-aea5-b83bb27743c1", "value": "T1CFF45A9DB690B1DFD8A7C5768FE86CB4FA61B877830F51279423159D8A0C98BCF104B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658388381, "uuid": "7ae6e208-dae6-4ff6-9e36-40dd8c55dfbe", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658388381, "uuid": "76fcbefe-c52a-4f50-a57d-b51c9f294f5d", "value": "12288:vho2HdOqm5CGoj6gQlV95DmdX8kPC2f/Gbe9wxTw/ZJ+xoHcu7TjiCQo4nTVdiMr:vm2HBsCGo5zaKMlATMlBL9OU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658388381, "uuid": "286dce3c-63ee-4317-8099-45ea58805c87", "value": 766976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658388381, "uuid": "a196f3a7-30a3-4938-b536-cfe47bdc82d4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658388381, "uuid": "0e507792-f92e-4e46-a03d-d1e76f4bd8db", "value": "DOCUMENTS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5610bb1e-092c-11ed-93bb-42010a9c0043", "comment": "Malware payload (RedLineStealer)", "timestamp": 1658432154, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658432154, "uuid": "05d8b29f-7542-4aaf-a227-cd86c6c5d68a", "comment": "Malware payload (RedLineStealer)", "value": "5911c72c0fc93d0c9c76e9c881bb06be", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658432154, "uuid": "325a66a7-c2ca-4699-8cf6-284c4f4f12e0", "comment": "Malware payload (RedLineStealer)", "value": "a3a6f76ddefa3fb54372ed3faf131b7ddc3299d63975adc328decd25517c8d67", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658432154, "uuid": "33241d11-e181-433c-aebd-c30cee88690a", "comment": "Malware payload (RedLineStealer)", "value": "f87895e780b7a8aa5cfcc0e35305af0bcb1cdcfd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658432154, "uuid": "aa9b071c-f68f-49a2-99a0-e0c49c5548db", "comment": "Malware payload (RedLineStealer)", "value": "afc02c2b8947ebc85389fe22a9a4f97e83fb00253ac3de6fce0845514035f49adcf63725811bb6fe54b5b070c347962f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658432154, "uuid": "35414cb9-552a-4b20-b20f-fc2ce610b2cb", "value": "T10D652334E542C177E1A209319D47E676B23AB9040B7C28DFB7D91D1CAC2327A1E6939F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658432154, "uuid": "0d35c633-1459-441f-aa2b-745e2afc0071", "value": "c9adc83b45e363b21cd6b11b5da0501f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658432154, "uuid": "42ce77b4-3531-4f49-a0ff-d1fa22a082f9", "value": "24576:pAT8QE+krKkJc8PYbRPqOhPbh0pJUIh75LW+c6tYj28yiJZFcq1lFUiBDYRkaY9P:pAI+cKkhmq5x5LWheY1JZFcq1lSiBxak", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658432154, "uuid": "921d1576-5869-4c3d-8d4a-4aaf657f4609", "value": 1536210, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658432154, "uuid": "685e2ca5-325d-4dd0-91a9-1249a9e2f293", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658432154, "uuid": "ac5ce636-7a70-4467-bedc-6346274c5b88", "value": "5911c72c0fc93d0c9c76e9c881bb06be.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9f042fb-08be-11ed-93bb-42010a9c0043", "comment": "Malware payload (RedLineStealer)", "timestamp": 1658385077, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658385077, "uuid": "02d88cec-6fca-4647-87af-87e5a7ab624f", "comment": "Malware payload (RedLineStealer)", "value": "7feb667ac9fdac797ad2e148c84f086e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658385077, "uuid": "e7b953da-ac55-4a12-854f-111580a3e379", "comment": "Malware payload (RedLineStealer)", "value": "a3dab5e89517feaba18c29575d32c353518c326dc3acb4bebc7e43081cfeccc0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658385077, "uuid": "a540c5e5-45a4-48e2-8b7f-c4f6b89c9998", "comment": "Malware payload (RedLineStealer)", "value": "e386d2533ba09e39371281ef5bf008ac46b675ae", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658385077, "uuid": "e8324337-5cf0-4696-b67e-f2f176a23a4e", "comment": "Malware payload (RedLineStealer)", "value": "c7ce81f9e6911de3426bb403c89558d09046f7c0b2b2d558d07a9b6a28d68222d86cebdfcacd5adbe0cd692c72230bdf", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658385077, "uuid": "f97d7f48-c6dd-46f4-a6fc-59580b70ba4d", "value": "T1E1E40666739DDD64E0C04CBAEE3F69F8D9D26C78F816B2133680BEE9313E16145DA016", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658385077, "uuid": "9d3838ee-2376-4b7c-8207-79bca7a6bc67", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658385077, "uuid": "c69f3318-ff41-45e5-b070-7c474d345a9a", "value": "12288:Kbkisdv1MmLw3iAFniPO5LjFk4r3o3Dih:S8vsnUuLxb7e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658385077, "uuid": "7578ea6e-ad05-4095-b9d1-c968c9494944", "value": 698368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658385077, "uuid": "a87ca75d-7387-4f7d-8d1e-533033f5cddd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658385077, "uuid": "ebd36919-1bdd-4484-a8f8-d4b16689d914", "value": "7feb667ac9fdac797ad2e148c84f086e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f05e02f-08ef-11ed-93bb-42010a9c0043", "comment": "Malware payload (RedLineStealer)", "timestamp": 1658405836, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658405836, "uuid": "1f34c636-63ee-476e-9a07-3220c2cab5fa", "comment": "Malware payload (RedLineStealer)", "value": "2245ceebb4f41b58f3fd35ede36d516f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658405836, "uuid": "860af283-88e9-4315-a453-45b9b5f24b6b", "comment": "Malware payload (RedLineStealer)", "value": "a66ed99d15b13f24a02d9ed7c53788b183f74cb48539f9a1056e6773922581f4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658405836, "uuid": "9a631483-c0ad-49e1-b91e-9577e0050c5b", "comment": "Malware payload (RedLineStealer)", "value": "82eba07a3d333d80235bf64e627943852edda4b9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658405836, "uuid": "2ec40141-e101-4059-82df-5baee5617dec", "comment": "Malware payload (RedLineStealer)", "value": "0e8301dbb06883bedbc9f4c086c3fe218d34a9b11bab03eb2ca61c73e08aea1f970a064a31a34cf588857ce1a6c49efd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658405836, "uuid": "1739a445-accc-437b-abd6-2f631d220608", "value": "T1E084C000BA90D435F5B711F44A769268B92D7EA0AB2050CF72D46AEF97396E0FC3171B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658405836, "uuid": "0e2af019-6a1f-4132-aafa-582e07fe829b", "value": "89c35d8c74820f04e6fcc9097b9e8b18", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658405836, "uuid": "55bbacee-d562-4200-9ed2-fcdcc80e7d59", "value": "6144:LlICE4klNDaRs3Iwx5uFGbKvBD6sF7EPC77lnFvGtzvlmevLRlklfD6:OtNma3Im5uFVv1t4KHxdEzjzR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658405836, "uuid": "d16247dd-d163-4cc4-a24d-e042f61465d4", "value": 405504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658405836, "uuid": "95862e1a-48fb-44b0-8066-90e660c6a993", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658405836, "uuid": "4d809d9a-a406-4a24-8b56-bde7a253cebd", "value": "2245ceebb4f41b58f3fd35ede36d516f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26cd9db2-08fe-11ed-93bb-42010a9c0043", "comment": "Malware payload (RedLineStealer)", "timestamp": 1658412318, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658412318, "uuid": "dedde481-0eff-4caf-bb8a-e6d55fbde07c", "comment": "Malware payload (RedLineStealer)", "value": "dabbb45d94d56bd0389160b46eec0d6d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658412318, "uuid": "9c954abd-8cf4-4ca5-ab67-2a704da6d83d", "comment": "Malware payload (RedLineStealer)", "value": "a763f8a40226ac45eb2565ff62bde8aca89dd0e7bc334f47a56e3decbb31f9e5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658412318, "uuid": "bb44380a-9dc4-460c-8e9b-bcbcf1f39ed5", "comment": "Malware payload (RedLineStealer)", "value": "bf1f75b1acd3d67a757ef7b7e9302a01ae297943", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658412318, "uuid": "9a6644a6-92ef-4e04-93b9-f6ed12d79616", "comment": "Malware payload (RedLineStealer)", "value": "b8937c05c95921a6d7a359bc66b00760be24c3a1a5bb9cd95fefa4cb23719a94c8749f636e133a1ebc4172dc7eb38cc6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658412318, "uuid": "a385910c-84ed-42ab-a377-bc37d3ce2d5e", "value": "T10F447C10BBA0C035F2F756F449B9976C793EBAA15B2450CF62D51AEE4635AE0EC3130B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658412318, "uuid": "5d3723d3-977b-4a55-88cf-afc65babd0a2", "value": "47a65835858de3283b792cf915c137ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658412318, "uuid": "1a34671a-3ec7-40fd-b548-fe4bb6be511f", "value": "6144:4yfq0L8bOWpwBh2TrUNo2DrgpIWOxCefo5USWcCJ:4yfq0gOWpwnyrULng2EeoNWDJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658412318, "uuid": "c0176d5c-6958-4029-8224-e5395043d5a2", "value": 264192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658412318, "uuid": "4cd5473f-74ef-4eb1-b199-68fbd896cd1e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658412318, "uuid": "7b015d43-2842-4eed-93f2-7f224093145b", "value": "A763F8A40226AC45EB2565FF62BDE8ACA89DD0E7BC334.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6cc00a6-092b-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1658431994, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658431994, "uuid": "120f6882-d5f8-46a2-af87-97925d86e32e", "comment": "Malware payload (Mirai)", "value": "1310170cc21c50cdb8f0a56056f0b89c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658431994, "uuid": "d0928208-0401-4c51-beb5-70572870a81b", "comment": "Malware payload (Mirai)", "value": "a829298ed2db57d222afc7f8bec6679b5a2e033ae6d7741aac62bc9117d3c81a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658431994, "uuid": "2caf584c-75ea-4e01-a94e-7ccd419147fc", "comment": "Malware payload (Mirai)", "value": "4fb44c648fcf318a425e75222deb45b9601bdfeb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658431994, "uuid": "5aef8036-582d-479b-9f79-f29c6e6ab814", "comment": "Malware payload (Mirai)", "value": "367e4fed1b013860893a5c6301e9d529ae7e420c9f62d42e6e6831b138c0d4713d45f134bac97753952772c28be7d6e0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658431994, "uuid": "8ebfac23-9082-40d8-af07-724c60f93205", "value": "T11CF2E022832BD532CDB4DEBB9931C1E4296B47B0B5BE706477A4CA8D98C1B03C0FE506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658431994, "uuid": "1f7892ca-bed5-4b61-b09f-ed8aa3b942e2", "value": "768:VYVgAxkU1RHz5poClGL1aMnXha7WBNoWhSxHjt9q3UELCk:VYyAxdRH9zILLBBrodjAL7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658431994, "uuid": "567e406f-5c12-4c0a-b7be-2be07bcef46b", "value": 34484, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658431994, "uuid": "64297a6d-5cbd-467c-968c-686141cdd16f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658431994, "uuid": "a70bb6c7-5e92-4b5d-bb50-b8b694ada7ed", "value": "1310170cc21c50cdb8f0a56056f0b89c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca1b1347-08e6-11ed-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1658402284, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658402284, "uuid": "b3141614-cf5a-4f70-9da2-621941d5a04c", "comment": "Malware payload (AgentTesla)", "value": "6e738162dcb24b34a59d134fa41fb180", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658402284, "uuid": "6a7ef870-6e78-4f5a-a3f4-8c4dc0630606", "comment": "Malware payload (AgentTesla)", "value": "a84f13d151597f455c2c2bd8c6a7f97bb4069005cadfa6a22eddd17aa3a39b83", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658402284, "uuid": "ca65768b-41d5-4990-85c1-9d1403f96bb2", "comment": "Malware payload (AgentTesla)", "value": "521c81b25e8aa04e08607726fb58a3725bf43a37", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658402284, "uuid": "e725b168-bb0d-4408-a650-d7747a0e5cad", "comment": "Malware payload (AgentTesla)", "value": "637959b4e7df32d55533262771e3c9142b05fae685e823e2cc536568e630dc118b5d744330513e35ec8cac9fc8b65979", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658402284, "uuid": "aff9142c-e2c1-4b95-a3c9-0945be902e5f", "value": "T13124097E13C55D41C6EE41BDD0B6915811F0A7038366B38F6EE248EE1B172CEFA2A9D1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658402284, "uuid": "2f972ef5-c170-4de7-9998-6d45dbbf5ad8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658402284, "uuid": "4afd8d39-0f1e-4a76-b0db-e1af9d0bb517", "value": "3072:R0eI1JKU8gRxDOqmPPB8JXULVfDPUEG5kn28F1rGScLldz8NSlJuoQmW3:ueI/R0zB8qdUEG5kn2urPw7JdQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658402284, "uuid": "df19041d-ffb1-4868-abc9-6e9da1fcbc47", "value": 214528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658402284, "uuid": "b6fa204c-e194-4410-83bf-5afc7b336dc1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658402284, "uuid": "720b38fb-95a7-4a7d-900f-184b2ea6eb1e", "value": "6e738162dcb24b34a59d134fa41fb180", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56e130be-092c-11ed-93bb-42010a9c0043", "comment": "Malware payload (RecordBreaker)", "timestamp": 1658432155, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658432155, "uuid": "3ce07d0b-8bd9-4fae-b98c-a059aacd7ba1", "comment": "Malware payload (RecordBreaker)", "value": "8e3c62e0f33417dc283a95c7442a2de4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658432155, "uuid": "00aeb41d-383a-4e58-92a6-dae9d0906c0e", "comment": "Malware payload (RecordBreaker)", "value": "aa84c5a4dd2c28e2e8e77688ba99a361fd72509d841bfc9a1272554ed25be419", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658432155, "uuid": "7f1b3fb5-3684-47ec-b039-b91571175252", "comment": "Malware payload (RecordBreaker)", "value": "f11126a69b754668a9285193e82a20ac00bf7994", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658432155, "uuid": "00d93d8b-2fa6-427f-9ddd-61f11962d67f", "comment": "Malware payload (RecordBreaker)", "value": "ee323583a5fde3bbfaf659ae4f2f68795d7adaf50ba99d85d89878172a4a373f2fce5791042e3392b8a30d5895ed62ea", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658432155, "uuid": "407de6ac-ecc7-4894-8ed4-e8e0357386ff", "value": "T14E14BE6173A0C031E6A3153068B0D7B15FBAB9B2A771898B3764237E0F603D15AB5F67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658432155, "uuid": "d774eeea-56d3-4064-ae03-080e7f136227", "value": "085db6b068e0ab532921326907b886ab", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658432155, "uuid": "920e1df7-2754-4cfd-a854-01094b352681", "value": "3072:kHzyEwIuBIshNzTJ+T0TIp1COzeZSEvrAv/aGIM5XSEPclBMCjoRZmJtK3XBSes:X3I0NB+2ILCOziSemSGIGiEPcl+Cj0P3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658432155, "uuid": "5f0928ac-dc59-4f7a-8e50-8ff0753079ad", "value": 190976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658432155, "uuid": "a173a14b-b914-494f-9583-0b80c131a91a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658432155, "uuid": "67738f50-8e13-4e15-83ce-3c10d7ad6385", "value": "8e3c62e0f33417dc283a95c7442a2de4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9ac2cb3-08c2-11ed-93bb-42010a9c0043", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1658386875, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658386875, "uuid": "87f1f314-7d7a-4a56-957e-119be071af2e", "comment": "Malware payload (ArkeiStealer)", "value": "65e80868c88ee7755c1a312a7ff87fdb", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fake crack", "colour": "#6C1B14", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658386875, "uuid": "5840ad6b-1db0-496a-9a7c-d23b4638665a", "comment": "Malware payload (ArkeiStealer)", "value": "ab94eaeeb5f0f69611750b543827112c96062be9dd74e7f6bb7e1623455a38d5", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fake crack", "colour": "#6C1B14", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658386875, "uuid": "e4e1143c-9564-4af8-94d5-4dfd89ce6a1a", "comment": "Malware payload (ArkeiStealer)", "value": "1079334ac4ad344f43dbab0cf003f81c5289bb76", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fake crack", "colour": "#6C1B14", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658386875, "uuid": "8162ff04-dc91-4d70-8b48-e6a621ecb19c", "comment": "Malware payload (ArkeiStealer)", "value": "1841e94e91e716635625772b28a9a20fd462ecd5aa209357159b438d268a8f78604a887d3b18162b6a0585b021a13762", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fake crack", "colour": "#6C1B14", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658386875, "uuid": "4dc025ce-1717-4017-8669-09b7c00498e3", "value": "T1F7D52B135A8B0E75DDD23BB4A1CB633AA734ED30CA3A9B7FB608C53559532C46C1A742", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658386875, "uuid": "46a39490-d685-440b-ad63-d0f5ddea44aa", "value": "da0a8429d07681e0f845d1d4f08ae833", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658386875, "uuid": "121b9dbc-1688-4ed7-b246-b4de8f4616c6", "value": "24576:ibY3CTWJQYyY4DHuNcXgMDNdM6P1SbN0dheIK2o564Z2broWLCyLh7Il3RuQ553h:XCi3LcMN0zK2o5H2bkWLCySl3l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658386875, "uuid": "66eb0378-ed9b-4349-bc30-0fdf0a0dd56b", "value": 2760554, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658386875, "uuid": "da57e377-58d5-43ff-8442-8cb4f79c6a2c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658386875, "uuid": "9ba67af3-8481-405a-a92b-808dbe836eeb", "value": "Adobe After Effects crack.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58de36e7-088c-11ed-93bb-42010a9c0043", "comment": "Malware payload (RedLineStealer)", "timestamp": 1658363439, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658363439, "uuid": "072afe4f-bbc6-47c8-a6ec-a70b0c1e394c", "comment": "Malware payload (RedLineStealer)", "value": "5ea29999e8ccc75c762a566339cb2a27", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658363439, "uuid": "d17b5291-b836-4f14-a09a-0a2d061e30e9", "comment": "Malware payload (RedLineStealer)", "value": "ac4ad36aac14677d45794150a677a4ea1c6819270a0d569f46276287ee88f538", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658363439, "uuid": "63b214e5-6aa9-4aae-9880-6f4a62578016", "comment": "Malware payload (RedLineStealer)", "value": "b5f38faa4664f2a6641d2b876ce9fd411e3d450b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658363439, "uuid": "34f85795-3575-403c-8f79-51d9f2949ea9", "comment": "Malware payload (RedLineStealer)", "value": "b1b0d6be6b982af227a79f27400fc78cc67b211cde00b58232c1bd539e25440a4a514fbdfd144bd1a5ac6422c1969ebf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658363439, "uuid": "8f0e8628-3dbc-4e7c-8944-09c2d61a94f1", "value": "T11E847C680BA9C95ED3757F3868F0F36942B883E23C16C716DE6214E55E31BC8BD41AE1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658363439, "uuid": "201a171f-8adf-43c5-bdd4-99a3a9b0f3de", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658363439, "uuid": "47ccd63f-c9ac-499b-8fbc-4f64f27f88a5", "value": "6144:9cvHONT1kvcRIht4jSyPjurr99c1X7Gl9xmKSaPXzFmTlSvjyn4WzfEVYUlAfu:9cvHSWCIH4jSg+c50jmKPXSl0pW0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658363439, "uuid": "73f9a858-5915-40ab-bcf4-9e4753e84e25", "value": 378880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658363439, "uuid": "b678b868-147a-4098-8d5c-c431eb511d58", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658363439, "uuid": "b551c7d0-fdb1-4aa7-ac3f-fd4958e88f27", "value": "5ea29999e8ccc75c762a566339cb2a27.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8944296-094c-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1658446171, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658446171, "uuid": "2ce8db23-b9fc-4d34-b86a-7dc97bccd6ff", "comment": "Malware payload", "value": "0496464dfbab539f1c1b60f1c91dc492", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Lightning", "colour": "#7AD4FF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658446171, "uuid": "78132ce5-8280-4db1-98cf-ea6c17e12308", "comment": "Malware payload", "value": "ad16989a3ebf0b416681f8db31af098e02eabd25452f8d781383547ead395237", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Lightning", "colour": "#7AD4FF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658446171, "uuid": "63c9bb54-fadc-4947-9143-2dc6e270b101", "comment": "Malware payload", "value": "ee0aa0a88619572b315b800edf2c07bebff4dba4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Lightning", "colour": "#7AD4FF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658446171, "uuid": "39f5e4ae-345d-4ca6-a976-f86336fb934e", "comment": "Malware payload", "value": "81f0c396690b18a62393fb5503ae7a105b50323c07b9f0289416ebbcbfa52ff2ed5c4cf046a2f924c7ac3571a6212ecc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Lightning", "colour": "#7AD4FF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658446171, "uuid": "47841419-eea6-453f-8b5d-9a4bdc9b3e75", "value": "T15EF45B47B7A368FCC592C970435F9272B971B46452237E7F3684CA302E56E306B2EB61", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658446171, "uuid": "84dfabcf-0eda-4e17-99ca-7fc45a8417a3", "value": "6144:RXLavwAWoxu4rovpWNz9HJ+7nymv1sOzW/cPN1hJbLOBWDCIMoYV3WiaVIenrVDN:RX+IxvMpGn/NaojhBOcC3ouWXN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658446171, "uuid": "c189a917-8f20-4e90-aa18-889b29aa060c", "value": 724672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658446171, "uuid": "11f69468-2238-400b-bf91-e4773da2a80c", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658446171, "uuid": "7266f0b8-b097-4167-983d-2be730fe3276", "value": "ad16989a3ebf0b416681f8db31af098e02eabd25452f8d781383547ead395237.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59b3b3c4-08cb-11ed-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1658390499, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658390499, "uuid": "8dd36173-74b9-48cd-ab8d-3ea41f5c22bf", "comment": "Malware payload (AgentTesla)", "value": "30578d2b167b443632be8ab7ad1fd167", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658390499, "uuid": "329f09f1-7789-4470-8c66-4029affd16cd", "comment": "Malware payload (AgentTesla)", "value": "af691ef472259901d3fd41cb58b98d883d97ef7d49557094b4b3ae1c7c1ede65", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658390499, "uuid": "8132df12-3008-40d6-ba51-d508f01a0fd5", "comment": "Malware payload (AgentTesla)", "value": "180fbb04f12088e7f440608c91c24999431bfde2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658390499, "uuid": "f5bb3ee9-8881-4c7f-8af9-bc11fd440b65", "comment": "Malware payload (AgentTesla)", "value": "4d067effdb6559c5d5e0a0c4435acfebe2aa3f7f37d898b95565917835c072a4d8aba3e13eb77b1490dbecd855c010af", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658390499, "uuid": "425fdf9b-fad7-447e-a0f9-1384b1e23774", "value": "T13D840961BB845A8DB6980A8BE07C6DAE77F76B05C5E3B3CCA7933547255EF1D6208C00", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658390499, "uuid": "b8cc84ff-bf59-4d7f-b783-7e8ff741b3d5", "value": "6144:2NGGF4ToWJGrUyA206mCBWDCq84akRWYv9PCNPn4IMbeyszo:2UiDNnBmCq84a3Y24pszo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658390499, "uuid": "fa040cb9-d2f0-4a2c-b551-8246d383ef36", "value": 388032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658390499, "uuid": "c7ac41a4-51b3-4da4-9e46-a77fce587554", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658390499, "uuid": "a0c68f58-891c-4529-bdf6-c7c74aa139aa", "value": "Cheque-copy-pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4212db97-0932-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1658434697, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658434697, "uuid": "9df24f8b-3e47-435d-bb96-526c81dfe118", "comment": "Malware payload", "value": "a13859f02c0ef315b986282740f0952d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658434697, "uuid": "7b5901dd-fb0d-4977-91d6-37fe00d9c5ab", "comment": "Malware payload", "value": "b005c42c9af91e4f9f20b4840c81ea9598254b186d0a95da17ba9d2ff4be8f1b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658434697, "uuid": "95da4ab2-8823-43a9-97dd-a4330df44938", "comment": "Malware payload", "value": "350e3b5fc090ce8b81cace60c7f1687d9dbffcc3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658434697, "uuid": "950732cb-bf4e-4b18-a467-7844a00d306f", "comment": "Malware payload", "value": "64292a2849f14c1f9c8140b47ef2755939e7b209f1e981cc064cef4caf2e336ea6d5c067c889cac42c5706bb99d80604", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658434697, "uuid": "55d77b12-ef19-4cb9-9cea-a44d498f42e6", "value": "T1D4A34A17B71D0B53C48B5AF12CBB37F18BA9F6F112D76185650AAEC05B32AB02412FE5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658434697, "uuid": "1f67e048-7a0e-471b-8932-c463838600c6", "value": "3072:jE7wIsjgot+cM135Ye18kiDBEmW2VqEq9f8Z8:jE7Ujgot+cM1pYe18k2EmW2VqEq9f8Z8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658434697, "uuid": "b917e406-b376-4d14-94fe-20fa748089f8", "value": 101528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658434697, "uuid": "1da8343f-de9f-4c10-8903-f51fb3436ed4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658434697, "uuid": "f6533350-817a-46b2-a06d-ed3bc8087edb", "value": "a13859f02c0ef315b986282740f0952d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88e456f9-08df-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1658399168, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658399168, "uuid": "8cb7cc37-b995-4389-9839-61d614e94c34", "comment": "Malware payload (Mirai)", "value": "e1e9174eacf693ad232025b867e2b133", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658399168, "uuid": "3928664d-4f32-4991-b7d7-99d50ea51f2f", "comment": "Malware payload (Mirai)", "value": "b081812972bfc7bddb93df04b578d5949255bd861dc967551f2e3c49cfddb1d0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658399168, "uuid": "be9f5de9-8b80-4688-afca-9c65b04aa5d2", "comment": "Malware payload (Mirai)", "value": "7d358aff7f2a2478edd6719716ba69d95475299d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658399168, "uuid": "f0c76c49-a7c9-4f15-ab95-67c679e89671", "comment": "Malware payload (Mirai)", "value": "7f7aa7fad64b9c263f1de0264153979dc6ebe02de8daf63bba470f38c74f145b63e95998a142a32eeab2a3efeca0eba7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658399168, "uuid": "a760d9eb-ef95-40f4-a9c9-35255bef22eb", "value": "T1E523B4197E229FACF7AA463447B78E126A4833D63BD1D585E25CD6006E7020E341FFE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658399168, "uuid": "aad297be-3ea7-4052-bf13-d6a6f53f37e8", "value": "768:hpjXHpUUxi0o/YjStFQsPCgGhXu677IEAUleRVWinFCwz2:fWyStba7IE/e2qF7z2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658399168, "uuid": "4eb14f4f-d96a-47b9-8615-bada09da0a5c", "value": 47676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658399168, "uuid": "bffc2733-5d42-4408-a751-12e21904d2de", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658399168, "uuid": "0dbac1a6-2dc5-421b-8ab3-2a59d961316e", "value": "e1e9174eacf693ad232025b867e2b133", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5710151-0927-11ed-93bb-42010a9c0043", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1658430167, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658430167, "uuid": "2b3491a0-d7ce-4747-abe6-c4a2c6375005", "comment": "Malware payload (SnakeKeylogger)", "value": "dbdf884618b39d4e5d4b15cf4b17e04f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658430167, "uuid": "51df514e-f98f-4e85-8924-1ed2020f7b32", "comment": "Malware payload (SnakeKeylogger)", "value": "b0bf387f1217168a1f3e1ea260b3c4200f25839dfb58a80b948a3aac224e6b18", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658430167, "uuid": "54f5e9f4-a081-4ae1-ba25-e9808fa99bb7", "comment": "Malware payload (SnakeKeylogger)", "value": "7a4c85c1d4f6fc853be236d863ce7f7020888fd9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658430167, "uuid": "ca8a662d-955d-47d6-956f-3f673d02a90a", "comment": "Malware payload (SnakeKeylogger)", "value": "1723bc62e82701bc6c0415a13e421e67b49be7920e279fe8db51d8e183ede149e02c27af9cf752243a44f721966663b3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658430167, "uuid": "c5a97a8f-883f-4cf1-8cb0-7cd52f30cffa", "value": "T10E05122B72645CA7C12D89BBC531C8E06371DED6A192FBC11EC476A724B3B85D94E2C3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658430167, "uuid": "0732a477-3e9e-40be-9a95-06b682a5fea9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658430167, "uuid": "5af5ab1e-c0c6-44c2-8b4a-b47e32aeaf7d", "value": "24576:fhLuyyB5rWECN/DkDzQHeSQpMCGR659YQ:5Luyy3ryWZSQNGRGYQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658430167, "uuid": "bcfbde38-d699-49e9-8a75-21385c2382e8", "value": 830976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658430167, "uuid": "4d1a5575-1ff3-46f5-82ce-078bc8bd66d8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658430167, "uuid": "728cf4d9-ac53-4ace-b329-374300bcd484", "value": "dbdf884618b39d4e5d4b15cf4b17e04f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0788563-08d2-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1658393678, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658393678, "uuid": "1bfad2ba-1a2f-480e-9640-6d183aaa3395", "comment": "Malware payload", "value": "3ee861cd6b87750e42df3437a8b66b53", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658393678, "uuid": "f867ed50-c0b1-4116-88e5-e97a74fbdaf7", "comment": "Malware payload", "value": "b1321344183fc2a4b102120b482eb3d75aea9ca9d2127194044572d7534b1bd9", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658393678, "uuid": "3dd03c98-6695-4983-b55d-13fced8b7999", "comment": "Malware payload", "value": "d14444ca8ad99ba24acf2bd679b33ced7a426abb", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658393678, "uuid": "d6c30cee-9337-40c4-8987-f4876ad84870", "comment": "Malware payload", "value": "ce02844d6a25451f60d9fd17c6ef35adfaf7ae88e392633f3535082ada67769fcd49797f3940234f5d955d5e50b048f9", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658393678, "uuid": "f5ad9b62-765d-40cc-aac3-a3d49c88a505", "value": "T16FD3CF546BBBD0BEC1AD173D4CF526120B36FC4559F85C9D6AD1028E26A38C891BEF31", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658393678, "uuid": "9fb7f36b-a713-4850-b4a1-ac4552f405b6", "value": "40ce0e00f4a9407aa6991885acfe7b8f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658393678, "uuid": "d166e250-d88e-4e88-9e49-fb1beb43b4ea", "value": "3072:0IbXoEhCqIGEYcAk5VzP1xEI2i3TiAdrrX8oUiw3zrzOBNSWAZF+h6TS:dbX3ZgsiwP6Wfg6TS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658393678, "uuid": "e0e8e962-afab-4dd7-80c5-9128f2326cbf", "value": 130560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658393678, "uuid": "5dd36e61-8e1f-42ab-aafc-87715741fade", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658393678, "uuid": "934f3d0b-ef21-4957-9047-11be820d4f84", "value": "version.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca4c1f70-0928-11ed-93bb-42010a9c0043", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1658430631, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658430631, "uuid": "b9ea3822-83b2-4596-96a0-a9d6f5a0c84b", "comment": "Malware payload (AveMariaRAT)", "value": "e52cf92c4231b1939ca180857617fb7f", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658430631, "uuid": "8ed24e1d-1bd1-4311-8b3d-096441d47c84", "comment": "Malware payload (AveMariaRAT)", "value": "b214d2cc0a10006b66ddef1d2c8847ae130dc0ca01c8b8e2138cc004fae50435", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658430631, "uuid": "b6d83017-905b-48c3-bad3-45f85d83d96c", "comment": "Malware payload (AveMariaRAT)", "value": "f9d81c3386390123835a180f174bdcb873e1d437", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658430631, "uuid": "85ba79c6-1f4d-4df4-8228-fb0e794a8659", "comment": "Malware payload (AveMariaRAT)", "value": "57bcc26111f7ad093e8af217dc5f39dd8dff94a5d89361c7c2369e8550b4b56bd78136d1d4597e4417875e73c01bcd87", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658430631, "uuid": "ec7afeea-62d6-4058-ae21-58cd54dc8811", "value": "T1AE24DBB4685F08B2D708DD1E24A4B245AE79FEE774C1547223AFE034CF5AAF29EC8541", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658430631, "uuid": "b5f7b77f-1b90-4b04-a3e0-64ff96724721", "value": "1536:iezr5qSK7Jz7vH2wVFtUdo79/GKs8vFZVzFz76mAg5eeVhMDw5wfLc:iNZlLVzFtr5RDAw5wfY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658430631, "uuid": "b9bf0ad4-046c-4fb2-8298-1a31b612692a", "value": 228944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658430631, "uuid": "fad63d0a-0a95-47dc-aa56-ca7f432f5706", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658430631, "uuid": "9ae544b1-319a-4994-830f-d0c1d78449be", "value": "New order for month dated 072122.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ae4f695-0932-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1658434685, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658434685, "uuid": "9b56ceac-b5a7-46e6-8f65-18f1167b0ef4", "comment": "Malware payload", "value": "9f5916ba8d48e1fde6ba7bfec9aa52d7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658434685, "uuid": "03e2669d-d74c-4837-b8af-a3df6fee2809", "comment": "Malware payload", "value": "b29eca8a5a058365410d9b25bcf33e6931e15d4affaab3d13df2b75d355fb0b4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658434685, "uuid": "ee896ff2-57c6-4402-b92f-98261e6a3503", "comment": "Malware payload", "value": "4ee40f236d7c32fd43a7e731cf3b4efe20aa2225", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658434685, "uuid": "6d8389fb-ebc9-44cb-aefc-a500c562ce4d", "comment": "Malware payload", "value": "2324c8d6b80cdb4b2ae4d38ee8d203c611d670ef76c90585ce8f776cfec13199dc35f0f7af6780f2f3de8772a175e386", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658434685, "uuid": "57a0c48c-b149-48ed-904a-29aac80b8c6b", "value": "T110B33B41F8448767C2D327BBE78E439D3B3557A457DB33126A345EB42BC2B892D3A920", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658434685, "uuid": "19323e9e-930a-4e77-afd6-ca5d0026e006", "value": "3072:ZdRGTcX1y64rp7tPWKb+ymtRqQ44kyXIA8:WcXMxrp5PWZymtRqQ44kyXIA8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658434685, "uuid": "90c6ea5f-2ef9-4c1f-9a05-48ac1d758434", "value": 109572, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658434685, "uuid": "e6402db9-7ee4-4078-99e7-c49f206f93c6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658434685, "uuid": "af6ef044-41f3-4834-9a71-5d19dc77f328", "value": "9f5916ba8d48e1fde6ba7bfec9aa52d7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "705d92e6-08b9-11ed-93bb-42010a9c0043", "comment": "Malware payload (Socelars)", "timestamp": 1658382806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658382806, "uuid": "646a5187-051e-4651-a522-96da6dee8161", "comment": "Malware payload (Socelars)", "value": "011bf570a08141ba37dddc5359a5ee26", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658382806, "uuid": "51f11c39-a336-479d-a2fc-e6c92f2dc227", "comment": "Malware payload (Socelars)", "value": "b38c1a7623e5421fc80b3cbcc8db6f905b0a46d5496c275a80b43bf3f020f819", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658382806, "uuid": "0d7640c0-661d-45cb-b6cd-523ae7e869c7", "comment": "Malware payload (Socelars)", "value": "67742d468159c611971c6698a86c008b05c277dd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658382806, "uuid": "16a785e4-8749-4120-9828-184ab4a773e0", "comment": "Malware payload (Socelars)", "value": "a8a7c98dd6b25bdbf017474102dbe121198fa4c22366a656889e4458162edbb09e5631f3c0ef9d1f53e748982d302316", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658382806, "uuid": "d4abca81-f838-4bb9-b146-1caf69d9746d", "value": "T1DC659F11F642A036EDE300B282FF5AFE8D28B621031854D7E3C45DA95E615F37A37A5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658382806, "uuid": "eb0cee5d-ca29-4299-807c-b0ed944b68c6", "value": "d69e4c13e25f0ad622344ac56118c0df", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658382806, "uuid": "71154e9b-342e-4106-832c-b7f16ebd124f", "value": "24576:8sLp0FasdJu/+/dfMs2KLoyaU/5DejgtMyPtTE1ao/2BT3Ud:5pncZO+bCyPtTEsoOBjUd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658382806, "uuid": "cccb5599-4b93-437f-a1bb-5694476bfea0", "value": 1494016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658382806, "uuid": "12a8c768-0328-4d79-9d38-f5ba8349d4de", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658382806, "uuid": "d2a53b72-d9d0-4eec-8ed3-b32dd887029f", "value": "011bf570a08141ba37dddc5359a5ee26.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ff752db-08b1-11ed-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1658379450, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658379450, "uuid": "334c1bd9-7140-4f1b-a8c0-bcbbe5b046b6", "comment": "Malware payload (AgentTesla)", "value": "96bbbd9a75962dbc0c3db5908a55e8c2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658379450, "uuid": "9c9f124e-b628-439b-80ff-dd7080924ac5", "comment": "Malware payload (AgentTesla)", "value": "b396f3f9fa5b3acac6ddbd6699ceeff35c671c1d0d595a69b187c2a107cd31eb", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658379450, "uuid": "6a89998f-4bd7-4b28-bb91-bd933fd5fd40", "comment": "Malware payload (AgentTesla)", "value": "c89bc5922e351627557af26b6d5fd9bfcd112ba4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658379450, "uuid": "c61356d9-29c6-440b-8994-86bf09afee7f", "comment": "Malware payload (AgentTesla)", "value": "9c27c534c878ae0808237280b8aca567c3f17b2f67f0aba8fe5cf2e01da3105f9cf1db18a14ea6fa760877a9253abc30", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658379450, "uuid": "c10eaf8a-625c-430f-8170-757b4b1a5790", "value": "T1E1151233A1E4FB25CA7047F210A326881BF2711D3071E99A258FBADAA4D57D897503F7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658379450, "uuid": "70c6eef8-5fe1-4b09-b382-4d2966e7040c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658379450, "uuid": "24989926-1e9d-4a68-9c1d-1d98e2756e47", "value": "12288:ntslky/jbJQ9yXKZ+neYhUwhR3yVE+N8HiqLRPpBlmZmnApGnk6sMix8E31h:fWJT6geYh5SE+NN8PQmNGxd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658379450, "uuid": "9faedc5a-084c-4864-a296-44ca94d5e808", "value": 890880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658379450, "uuid": "8f3ace2a-db6d-415f-9b65-87e4402c2bb9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658379450, "uuid": "9b9de01e-8eda-4a1f-86db-0ae1e03e2e5b", "value": "samizx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9525781f-088b-11ed-93bb-42010a9c0043", "comment": "Malware payload (RedLineStealer)", "timestamp": 1658363111, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658363111, "uuid": "44412aef-e7c3-4945-b770-825f2e3cd270", "comment": "Malware payload (RedLineStealer)", "value": "0e3d601c47ba545e6a1f9f0ba0fd264b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658363111, "uuid": "6b38ce25-a07e-4721-9b5e-81d60726dd06", "comment": "Malware payload (RedLineStealer)", "value": "b3b19f5c5611b1fa9cdf5581384712060df90a518fdac776e7b5f1a5c18398c8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658363111, "uuid": "6ddcf0a5-8641-4a05-aed2-04f2a92ea75f", "comment": "Malware payload (RedLineStealer)", "value": "74d696d9079438368c6bf7eed1b95eadc3cf67b8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658363111, "uuid": "d921b49d-f956-4e58-aec0-f685ea599c17", "comment": "Malware payload (RedLineStealer)", "value": "d2f5027a1fa47b7b2081fa028a4719163f388fce0f4e9badabea8809480944582e7930759c1ac302d25baca9112d2dea", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658363111, "uuid": "d5c151d3-1270-4941-8b6d-565b38fb2d08", "value": "T1CD84C010BA90C439F4F722F449B69268B53E7EA1972454CF62D52AEE47386E1FC3131B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658363111, "uuid": "817399d1-7570-4112-beee-c5fab9f8c510", "value": "ee2737b8ef50f6ec99d37e09a01449f3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658363111, "uuid": "c57a8965-f2eb-4b52-a8fc-0cea304b0f99", "value": "12288:nmpTPOvDmpXcQSMdwru6A7Gva/nHRmv+s:YP2voduLavxq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658363111, "uuid": "114bdb00-5559-4972-a8ba-eaedae1200a8", "value": 404992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658363111, "uuid": "a09172a4-b4a7-47a6-9563-53d728ec006e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658363111, "uuid": "b16da91a-b2d1-44d5-84ae-a5cfba72bd38", "value": "0e3d601c47ba545e6a1f9f0ba0fd264b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad4259ba-08cf-11ed-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1658392357, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658392357, "uuid": "4f53e553-0bf3-4c84-b3a6-5f3f7fc1c439", "comment": "Malware payload (AgentTesla)", "value": "dd04ff1bb512c6a52f3faeac775783a0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658392357, "uuid": "f7b6db45-cfbc-4975-821d-b03b459a538b", "comment": "Malware payload (AgentTesla)", "value": "b43c148bc2dc8e6df6e20fdfab3251d4640fd77e6e58e380306f1970823eb9e1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658392357, "uuid": "4c26ff15-67b3-4473-97f1-e2a3291f2e4e", "comment": "Malware payload (AgentTesla)", "value": "11bdb459a5a0e124c082482523e2393511eb1520", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658392357, "uuid": "35e6fe56-d45a-4305-906a-ae6d4ba2ff20", "comment": "Malware payload (AgentTesla)", "value": "8c6db8db1cb943ac7fb16a5ab5f215a54c749c58b54649b3478436c4e044e8da98796acb46804b9e4d88f85a59f79369", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658392357, "uuid": "42a5c361-d2d4-4743-aab3-99fd35b012f6", "value": "T188F4DF19B767CD13C27813F6C1C2001493B2950A916FD68BAECA22D61B467EFD9C97CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658392357, "uuid": "7169aa20-fdfe-4ac6-8ca5-afd73ad7d8c3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658392357, "uuid": "5d6412fd-26cc-4961-9a72-fd67c83839b0", "value": "12288:trNNeLAU31hyBoSqfiQO9326ZiDfCWirqT:fNeLAIuoSqq5x2YiD6Wig", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658392357, "uuid": "160e3302-df17-4c62-95d8-896f38312cac", "value": 765440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658392357, "uuid": "6f627397-a52b-48b5-aea2-5607c0a5e81e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658392357, "uuid": "716f02d5-df11-4e50-85b5-2c39baeaf78d", "value": "Pago_Transferencia.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a8f68df-08c9-11ed-93bb-42010a9c0043", "comment": "Malware payload (Loki)", "timestamp": 1658389615, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658389615, "uuid": "5ea038d5-fcd2-4999-b4b8-0ff6f7b738c5", "comment": "Malware payload (Loki)", "value": "17c1625c8944ca279eaa43a9ff4cbcd1", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658389615, "uuid": "b68d7bad-51d1-46c2-8f33-8f2633786b45", "comment": "Malware payload (Loki)", "value": "b45bc12ac43174c2e08d4fa12bc122abce27f2b1bcf17192cfa83ea70b280052", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658389615, "uuid": "c227143a-9910-4513-ab4a-0612fde50262", "comment": "Malware payload (Loki)", "value": "ce4c48e5d91220326d3bd9f5fdee0b256397df96", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658389615, "uuid": "e0ac17d9-a947-433b-98ae-74f41c6e7fa3", "comment": "Malware payload (Loki)", "value": "1f0b911d587d399ee73e21b0b83930f21c406e64eab904c2b8b22354c23feeb7e15bebe7d913f392fd273374b8f15fe2", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658389615, "uuid": "3073e6b0-f000-4d47-b49b-f31ec708cc03", "value": "T1D8642317BD2DA701F66EE0BCCD99C9CCA4A4FC44EB437B4922207442D3BD1DE9619678", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658389615, "uuid": "4fe16336-0930-4e9d-bbd8-5fbd3a7d1712", "value": "6144:sWkH3mP7q93HihfTIJHhFsiCHdSJlN4AKwy9JoHzeC35mo0nhYaW1i3NKD+hPlO:sv3/93HihfTmHhYdSJlhy9Jo0TrwD+hk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658389615, "uuid": "6ce72c7c-e497-41a1-b93b-14caca5e856c", "value": 333256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658389615, "uuid": "25f32a98-694b-4f02-9f89-4429a78bdda1", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658389615, "uuid": "bc2745dc-0baa-4dd9-9ece-770688907aaa", "value": "MV WORLD SWAN.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd7c0df3-08ee-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1658405752, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658405752, "uuid": "8bb4f387-55f5-49de-8961-a6a797889f67", "comment": "Malware payload", "value": "c338918d3a27d6556b88dbc8e89fba76", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658405752, "uuid": "17d76df7-4354-43e1-876b-8b532271e085", "comment": "Malware payload", "value": "b545d570f5d7141ce6cdf7068c65a16e1e2f7e10674ae9c84ef7fd8751ccdaac", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658405752, "uuid": "cfb8924a-9a39-410d-8676-30f8a2d233c3", "comment": "Malware payload", "value": "cf0b5f53a1a761709c8fb0f5e9a3d462334ca9d7", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658405752, "uuid": "1f5e1f17-c2f7-47f9-b889-317b29719700", "comment": "Malware payload", "value": "fb8b8e3076881ba14e7b7d3888db324737c5f75ad2d3717bbdea24fef8aa65b81dadf93fa2717137b3ac7866f1bd1feb", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658405752, "uuid": "fd875a56-61ae-40d1-ae7a-a4f4554ee089", "value": "T18FD2E13DD6883C81DDFD2CBED4985B219EC960C17ECE67CC47099C06662DF07B62A4A5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658405752, "uuid": "4d3b519f-5246-4718-8b95-545a2943f42c", "value": "768:xGW0zbXrLwl6m6vWTftMofEl3nU3H+KQiWMt:xGBLrLxmKWTftLEJU3Kw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658405752, "uuid": "fb531078-7fc5-4269-ab5d-66547c0ffd67", "value": 28576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658405752, "uuid": "a78533b0-e0dc-4cb4-b906-c28b31b57710", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658405752, "uuid": "1c76a1b9-b79d-4dad-86df-e187b32b9525", "value": "yakuza.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30c41bab-0915-11ed-93bb-42010a9c0043", "comment": "Malware payload (RedLineStealer)", "timestamp": 1658422213, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658422213, "uuid": "5ccdd920-c48f-4ec9-bdcd-366729b05e7c", "comment": "Malware payload (RedLineStealer)", "value": "07a5858a1df5330936c841aceec323ac", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658422213, "uuid": "5599f66f-33d0-465e-b1a7-6b194144ef9c", "comment": "Malware payload (RedLineStealer)", "value": "b5f48fd269e53ac78fa00c3e2793e7f8c8a9cdb5f6b3cf0203ae06ee5572a845", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658422213, "uuid": "9c14340a-7666-4888-a7bf-1ac45e2a9387", "comment": "Malware payload (RedLineStealer)", "value": "21c2b447cfdb496cb7a245e2222bcb764a7540b5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658422213, "uuid": "72b8da9c-ebac-466d-afd4-06e549917297", "comment": "Malware payload (RedLineStealer)", "value": "50d8e8164809205f3e678a345c4fdc74d0359ba7b420702a3b372c7ac3a35c4d653457e24b7620f7db181a756a166373", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658422213, "uuid": "84357c11-164b-4ac1-837f-44a61d625ada", "value": "T18454E1D17990CC73D4A292315870C6B5BA3ABC339971568FB3683B7E2E712D02A75393", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658422213, "uuid": "573a8a6d-cfab-4f00-89ce-c103a083aa8b", "value": "b87c62264ccceb96c52705a75b76beba", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658422213, "uuid": "96ec107d-a2af-453f-8fe6-76989b643f77", "value": "6144:mga7pCg00lpvSD8ZNnaY8y/rAYwhMmPuYju2prO6W:YdHiwjnazy/rGlPzjn66", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658422213, "uuid": "687ae41e-a096-469c-b47f-cc7e30b3f20a", "value": 296448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658422213, "uuid": "e19789fc-1db7-4c9a-ad24-188bea89f025", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658422213, "uuid": "55aede0f-df48-426d-92e9-b16949e075ba", "value": "07a5858a1df5330936c841aceec323ac.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d924d09-08cf-11ed-93bb-42010a9c0043", "comment": "Malware payload (GuLoader)", "timestamp": 1658392331, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658392331, "uuid": "e5a9274e-f90b-4fd3-9e4c-3f5cb353932b", "comment": "Malware payload (GuLoader)", "value": "17a9f98acb4c9ce1bd3b67f637c35ec6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658392331, "uuid": "972ddfb4-e676-4391-85a3-ae22adc98615", "comment": "Malware payload (GuLoader)", "value": "b75f0520f391edee50a5de8c5d0e65c544b8ed2da8323b42776fd0df788247d4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658392331, "uuid": "056bb5e4-4fed-4ab2-b3eb-979f01c62a25", "comment": "Malware payload (GuLoader)", "value": "a84297ae50baf4a8669fc1981b7bac2a4e53c26d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658392331, "uuid": "979724ba-90ee-4d11-8b3c-45b778cc98e4", "comment": "Malware payload (GuLoader)", "value": "d6009ee875025f170e8b93184d47b1ec27d4832af13a3904e9750856c83dabb13bbd07784f8bc792d9da959e41487402", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658392331, "uuid": "a4787a5e-ec4d-4f6c-99b3-7f5a37855f53", "value": "T173E409655532B807C1C78A70F53092F29F606D9494F3885F26E1FB4AED7FBA10A27887", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658392331, "uuid": "6f3bb25b-2a9b-40f2-935a-a6935c87076f", "value": "5f0c714c36e6cc016b3a1f4bc86559e4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658392331, "uuid": "9aebce9e-0e1a-4355-9baa-538dad72cfbb", "value": "6144:z1ssjoruNxdoWcofJfBwud/6D9PkzZgrihLqDtbaUS9UKqagyDWjLhZrcs4r23h:SsMQEAf3+9PmZgztbaUA+agQ4htcsb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658392331, "uuid": "45a762ee-b492-49f4-8baa-7e7b04a64bbe", "value": 701928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658392331, "uuid": "72231ec6-7ff2-49a8-9407-f8ba5a54e9ef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658392331, "uuid": "82c17d27-b14f-4b42-a67c-fc75df9ce155", "value": "Confirmaci\u00f3n de Cita solicitada.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f69553bf-08fa-11ed-93bb-42010a9c0043", "comment": "Malware payload (OskiStealer)", "timestamp": 1658410949, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658410949, "uuid": "5d150a67-d0fa-4082-b57e-c8f65d398ac6", "comment": "Malware payload (OskiStealer)", "value": "3e0559f907c481442d53ac625c3d98b0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658410949, "uuid": "994bca2c-074f-497d-b497-573b46b17ca4", "comment": "Malware payload (OskiStealer)", "value": "b7bf04a5d5d14c38358fb28f8e2453bf45926684769ad6a79a4bf110d8587af5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658410949, "uuid": "42e8dfe5-1210-4b33-a56f-b44a1cc684c2", "comment": "Malware payload (OskiStealer)", "value": "acad6550d0d9a43d791cd5aaf78237053ab2e9e2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658410949, "uuid": "c02537ed-3581-4ddc-901d-73c7b48c0372", "comment": "Malware payload (OskiStealer)", "value": "80c6e2117dcd1ae25b3949668f581ab5c3d02d6a9fe960cc532962511e9bb042ff6c3464a91006d49f81f0ccc432293b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658410949, "uuid": "8a06c170-b5b3-4eb6-afc2-afdaa99fbe52", "value": "T160A4F13076708A4CCE03BFF234E226C6D9D86E5B1A34946125CF7765B6733BC26AD621", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658410949, "uuid": "5019051c-4421-4406-a94d-49111677d7ca", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658410949, "uuid": "7a46c98d-b6c8-4a3b-8b95-5e42ac5a93cc", "value": "12288:8eDlusrbBqKn3g2L8NRQL5k/pjlR94kNEcN:8eBumbBqKn3gNRjlj4q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658410949, "uuid": "a373ab1c-14dd-4bc2-9847-cb9181044da5", "value": 480320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658410949, "uuid": "51a09802-c808-485a-b0d2-8e959ddf49c0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658410949, "uuid": "90726c61-afa3-45e3-b57b-eb8f62df5dd1", "value": "os.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3202df85-08b6-11ed-93bb-42010a9c0043", "comment": "Malware payload (RedLineStealer)", "timestamp": 1658381413, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658381413, "uuid": "7099200f-909c-4047-87ae-5b6dec4ef157", "comment": "Malware payload (RedLineStealer)", "value": "e8d4bbea9840e6a054102ef6f9605a48", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658381413, "uuid": "d91a9222-7c41-4bea-a395-1065c4714b48", "comment": "Malware payload (RedLineStealer)", "value": "b7f0667c8b604e117cc9f12744555ee7287f18553b4dcb2efdd936c270bfefac", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658381413, "uuid": "705d8852-b1ef-4714-ad09-32e5ee584204", "comment": "Malware payload (RedLineStealer)", "value": "9333285d5ef3e82f5cc99efd194c7ac97386c456", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658381413, "uuid": "45ed2717-3d6b-4fc1-99c0-1c6fb693dcac", "comment": "Malware payload (RedLineStealer)", "value": "c90eeeba047fc65b3cfd3a21159f2bf230f716f0962ef2272a1eb6a09eb5cd1d4959029758bf83d59cd2671cee652ffd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658381413, "uuid": "aed07762-420e-4288-ae8a-03681f51222e", "value": "T11E84C000B690D835F4B722F88A769368F63D7E919B2454CB22D43AEE57346E1EC3131B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658381413, "uuid": "87eec6b5-de0c-4411-b200-b77acb670b59", "value": "4936bd3bf59f423d7f275b9b0ddc252f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658381413, "uuid": "d092e492-98cb-4750-8491-ab8dd068cbfa", "value": "12288:jyzXVDRLhIV78a96TWv4xP/uFNIsjgK+B:mhDRdaJMWgR/E2K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658381413, "uuid": "c5bf5103-f459-4970-b631-5f9192eb9c44", "value": 405504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658381413, "uuid": "4f237898-2cd1-4a52-8aba-737397dd0d42", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658381413, "uuid": "f8aacfa8-fca9-4ff5-926c-9369607aa1d9", "value": "e8d4bbea9840e6a054102ef6f9605a48.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ae854ad-08b9-11ed-93bb-42010a9c0043", "comment": "Malware payload (QuasarRAT)", "timestamp": 1658382851, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658382851, "uuid": "31218fc5-138d-4d3a-a18d-9a5f5d8e8a56", "comment": "Malware payload (QuasarRAT)", "value": "8126816aef1cdac348dfdf1506ec7a80", "object_relation": "md5", "Tag": [ { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658382851, "uuid": "7976c1e2-68af-4e64-bd27-15c6a21f7bcf", "comment": "Malware payload (QuasarRAT)", "value": "b9d9a182e7f6f1afaf0f5058def2ca3e4e65f71a387c228c0a098b6c41b6d319", "object_relation": "sha256", "Tag": [ { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658382851, "uuid": "5a0cd96c-237c-434d-b60b-69f580c50b39", "comment": "Malware payload (QuasarRAT)", "value": "9de958bedc0663ef84c36412c33ac721d217594c", "object_relation": "sha1", "Tag": [ { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658382851, "uuid": "1e00ed66-18e5-49c7-938c-2b5650fea6e1", "comment": "Malware payload (QuasarRAT)", "value": "8f24358b6a26213438e49d13324995c60207dbbaddc62f5d634df70d7e95389259ece2a75c3a7c845f68cd290450ac21", "object_relation": "sha3-384", "Tag": [ { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658382851, "uuid": "f6a038e3-2780-47b0-8091-4081f9d71fe1", "value": "T13673091735A7D879C0958B352CF1F5AE3B32FC366E1A82677240B3AEAF70291C913585", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658382851, "uuid": "cd54082e-c07e-49f9-944d-caceaa5a3b05", "value": "1536:f+rxEtjPOtioVjDGUU1qfDlaGGx+cL2QnAeqMXzC/VYNR81il0q:f+rxEtjPOtioVjDGUU1qfDlaGGx+cL2u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658382851, "uuid": "045a503a-f0f4-435b-b14f-d70937841410", "value": 77824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658382851, "uuid": "22b58ff0-977c-4c30-be15-9a005de8c81e", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658382851, "uuid": "00e69d1a-7e6c-4e16-ab73-69f698694e1f", "value": "Order Payment.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8695d60-0927-11ed-93bb-42010a9c0043", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1658430252, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658430252, "uuid": "df45a849-1a39-4399-bb67-7325eae176cc", "comment": "Malware payload (SnakeKeylogger)", "value": "9206d3ae586a9f95b061e9ae421f95c3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658430252, "uuid": "c471ba4c-73b1-40ab-8988-6c3550bde7e7", "comment": "Malware payload (SnakeKeylogger)", "value": "ba7fa01438610d59a23d6daaa7dac208e3a99ff8dd10dfd6d9be2a59d4ff557e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658430252, "uuid": "5cc148f0-bcf3-47ef-950d-4dc1af2c94fe", "comment": "Malware payload (SnakeKeylogger)", "value": "0279651ca3cf0187522f4d2ec2eda69536e2fc3e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658430252, "uuid": "de412b1e-5d8d-465d-86a5-6bf2b5b8c547", "comment": "Malware payload (SnakeKeylogger)", "value": "a64e4f02e8932029f3ea61b0fe4df559dfb58ec1ef5d727aa602f66e25cd1a85410c405c8333d564cb8a0efb40055004", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658430252, "uuid": "aa645a76-f2bb-4c04-9d4b-888c9c50729f", "value": "T178C4F136B1FBEA11C67847B280D3564806B2B3097177E98F38DE619A85D13EB4B407E7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658430252, "uuid": "fd0fc471-db37-42ae-a454-46269d030917", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658430252, "uuid": "8b8da6f1-e6b3-497a-accd-f7108c66ab44", "value": "12288:nyeigg31hohWO9Dx8YtbCV0Vfr/KwSWfhcDx8:nyxo8oFTtmVOTlHhcDx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658430252, "uuid": "82cf3846-ed4f-4563-abd1-98bbea52d22e", "value": 565248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658430252, "uuid": "4277f9c1-bac2-435b-935e-97ea78be1404", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658430252, "uuid": "0c15a4d8-172c-4cb0-af65-0d0c99f498f4", "value": "pay slip.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cdedfd7d-0912-11ed-93bb-42010a9c0043", "comment": "Malware payload (Quakbot)", "timestamp": 1658421188, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658421188, "uuid": "6c9b407d-a843-4c18-b119-d22af24ff80e", "comment": "Malware payload (Quakbot)", "value": "c03de59890bb60e2157efdfa0ffdcf2e", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658421188, "uuid": "38888ff5-2e3d-4a2f-8400-2ca9ecb8ed62", "comment": "Malware payload (Quakbot)", "value": "baab5c1c7d6d199435c7e9c72aedcf0a747cf671768e783ad1c7070af0b73bfa", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658421188, "uuid": "ee0f5239-ab01-4ab6-8b2a-5fe4e309647b", "comment": "Malware payload (Quakbot)", "value": "de35d25fcf8cddb0acf8bb2669fcdeee07f096a1", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658421188, "uuid": "ee1cb6e5-e42c-4a7a-a6de-aad2a0fdccfe", "comment": "Malware payload (Quakbot)", "value": "1be0dfc15a46c889a7dd81cf1d9830a387010570c9e8b7f8db02ba56b164f10f58b7c25b94747046d57bc832e178210b", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658421188, "uuid": "257a729e-b116-4ec4-8989-da1820f45c85", "value": "T19DE49E32F2F14433D1761A7D8D7F9668A8297F412D38994A2FE61E4C4F396813A27387", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658421188, "uuid": "b02a5ac7-bc71-4edc-a51e-9474ff49ad2b", "value": "35c0671f6da08d6424f0383914847dca", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658421188, "uuid": "52c7c1d7-0621-495b-9a36-15b82c191dd1", "value": "12288:Fm7UnRfVgZK5uH5yYTKGhkJ9JWUjH5WQCFz0pKuQnjhVh7SNE:FmwZGZJAY17UljiuQlVJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658421188, "uuid": "6474a595-2718-4910-b2f5-3301c7a388df", "value": 679424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658421188, "uuid": "f550178c-594e-4777-995d-72fe94ab2644", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658421188, "uuid": "1cfcdc0c-d7f1-4323-92b1-ebd15e6ce412", "value": "7533.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8c1ada9-08e6-11ed-93bb-42010a9c0043", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1658402309, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658402309, "uuid": "83b76fb0-4029-45b5-a6d2-d3530b95481a", "comment": "Malware payload (AveMariaRAT)", "value": "f60f99881b2bef5e98d055432e57497c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658402309, "uuid": "96d0de52-4b8a-4d04-9d2e-24ce0c6e70ef", "comment": "Malware payload (AveMariaRAT)", "value": "bb11afb98f41a9ab5f5a8ce84ff3f5202d993efb1cfe68d4bdd4e89e0b01c8f2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658402309, "uuid": "7916b0ea-37b9-4fb8-8958-8960414f2322", "comment": "Malware payload (AveMariaRAT)", "value": "17b2e853b6a5a00d8d868e26246dc0ae640048f9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658402309, "uuid": "159bfb83-1648-4e27-88a2-341b799b05f3", "comment": "Malware payload (AveMariaRAT)", "value": "ed2d8f9110af0531a0b405612e5a5c3b5e79566fa0b640b06371dcf409f0b16935b64eba133e51e3195186412cb801da", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658402309, "uuid": "926d16ba-3b4e-4d3e-a046-366615a4a0e8", "value": "T189D39D23BBF74436F6F206B02DB87E6597ADFA300625C59BA3944946AC32C44FD26353", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658402309, "uuid": "10dcf625-93d4-426b-9170-7679c0dac27e", "value": "ef804870e7f7c9feae20101fdf049fe7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658402309, "uuid": "a4110927-a5fc-4d39-b8d2-1ac59a20a780", "value": "3072:5sAEZmjIxrUObrt/CRkQE2hB8qWjJ+oCz4bVVLTPmU:52YIhrrtqvoTCzgTLTPmU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658402309, "uuid": "c4e5a5d2-37c2-4dfb-9209-7af9e0eeb834", "value": 135168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658402309, "uuid": "0c86de2b-4520-41b5-9401-0bd6596c883c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658402309, "uuid": "337bf4b3-a383-41d0-9bd2-ca04aa6a080b", "value": "f60f99881b2bef5e98d055432e57497c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d4e3325-0950-11ed-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1658447628, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658447628, "uuid": "a71054c7-79f6-4784-b13d-721e2babed62", "comment": "Malware payload (AgentTesla)", "value": "ac83466260f48fd4becfd4d552dbf702", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658447628, "uuid": "cf14ab4d-1149-45e8-ada0-b7b5aa8daae2", "comment": "Malware payload (AgentTesla)", "value": "bbcde46af6297fb4afa9fbf5ea33455192bab9662f5bd58016b77afb89c27b1a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658447628, "uuid": "59ec7415-036e-43ff-a0c6-3404a1948fb2", "comment": "Malware payload (AgentTesla)", "value": "22d4402e3e145435b7bc0de15039f5b8c5fe941e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658447628, "uuid": "9778a8c3-6af0-458c-8f53-929aa55d06bb", "comment": "Malware payload (AgentTesla)", "value": "591272a645ad50d1485b413fcd7b4b4f5412a5aa9018a5fe24cc0210f7ebaa11f59c791e352de7a2c46cd999898b628b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658447628, "uuid": "3e9d7f46-da87-4927-aad5-a1f48f369064", "value": "T15AE4F1262B8D8F3BC516F3384421318217E53F91BA26E35D5E4222BF58CE6D24E553FA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658447628, "uuid": "f21b2752-c8d3-44ce-8166-4b7535651a1f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658447628, "uuid": "513f5c07-d29d-43f1-8e65-0e982dad4233", "value": "12288:mLKC0vteSzC7v+0gK7KBFCiv95ZLAtNmJiwpkvXtOeO4QpyeF7VEy8kgQZcg0:mLMvAZ7Vgemoid0TuKvXtOeO4QpyOLcg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658447628, "uuid": "7e546f36-0986-4ae0-acec-153d54ae9e2e", "value": 688128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658447628, "uuid": "74e7128d-a1a1-474b-8543-469f56d8f17e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658447628, "uuid": "bc023252-1e8c-44db-a47d-cc8c70c27c99", "value": "scan1962.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "850d721e-08f1-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1658406893, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658406893, "uuid": "32ff95a0-459c-4fc5-9bf8-0fc440e09cd6", "comment": "Malware payload (Mirai)", "value": "45446651731d558c27637e862b544e78", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658406893, "uuid": "6a6112ac-2ce3-49ef-985f-e2042a737af6", "comment": "Malware payload (Mirai)", "value": "bd634819054037f4079d5c952cf650cc7009932bd6c100f72ec65cc2af811ba5", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658406893, "uuid": "b1049a26-c5cf-4786-bb1e-123eb78f62ee", "comment": "Malware payload (Mirai)", "value": "a3767979fe5459ec5489037151027ef86e252e5b", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658406893, "uuid": "f9148749-f1eb-4546-80ec-d00663cc3e2a", "comment": "Malware payload (Mirai)", "value": "433c6301b510b233fed415ddede8ec0db5b1c43c9ea201fae39de4beb729cf2f5e9af8fbe8a0f17dbc5b3feca29377c2", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658406893, "uuid": "e3898bab-10fe-4f39-9a40-546b42225712", "value": "T18EE2F19217EAFC30E1729D39C6A8CB07EE950AF8A0B70349BDB5665C2814D0999FC351", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658406893, "uuid": "7ecb52cb-0d96-4bf8-9214-da943052894e", "value": "768:Oj74okSixfArOhzOcxVL2L1RNiiCTHjg9s3UozsT:OVs1g05iL1RNiiCT0Azq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658406893, "uuid": "c869524a-c711-4b21-8c93-67435e8762b4", "value": 31348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658406893, "uuid": "d1d321aa-a0ed-4dbf-941d-2a0ed195042b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658406893, "uuid": "48a09a86-6f08-4303-9dd1-8d02c6bb8f06", "value": "home.arm5-20220721-1234", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34b60ab1-08c5-11ed-93bb-42010a9c0043", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1658387860, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658387860, "uuid": "d4072cf9-3853-4c8d-b412-cda27d71f926", "comment": "Malware payload (SnakeKeylogger)", "value": "bdf95e417535b45ac3473a99a7221908", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658387860, "uuid": "f01ba949-3dc0-4bf8-879e-c480cbbebacf", "comment": "Malware payload (SnakeKeylogger)", "value": "bde44d28af8eea00ebb87e8a609fba8ed3e7371dfc1b5b842ef1a2aac4a0819c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658387860, "uuid": "ada313c4-8281-4e94-a87c-efa4a71368c1", "comment": "Malware payload (SnakeKeylogger)", "value": "ee1f8e6c1f27d5c079475bc9d8b5d2c8dac962ee", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658387860, "uuid": "83c67fca-712b-4b02-98e6-98167e3134e8", "comment": "Malware payload (SnakeKeylogger)", "value": "8de5ba5c2c3c46ef424ca6ba31907c636cbc23be13e49d6a1efdd702b29456d59078003b743f7af00345d7ab2a9851b2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658387860, "uuid": "7cbf05ca-282f-40fb-a332-248ff814f075", "value": "T1FE357ED2F190C89AED6B06F16D2BA53014E37E9D64A4810C559EBB1B66F3342209FF1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658387860, "uuid": "b9b2d32d-0328-4b6e-a6a7-1b70a062c050", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658387860, "uuid": "4423815c-0a3e-4073-8992-cc679dbbe7be", "value": "24576:WPmrIoY6uxLrmzT49FRxoi6XCi6puedde0xN:Wu66ia8F/oT+gV07", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658387860, "uuid": "22302f84-0f04-43c6-8a08-956d882c372e", "value": 1120768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658387860, "uuid": "62b46b91-1697-4acb-8687-6e907e28de87", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658387860, "uuid": "ad35048a-2306-4e86-a600-d308a7ec1d86", "value": "detail lengkap transaksi.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a73d3c4a-08df-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1658399219, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658399219, "uuid": "69fb7433-99cc-4534-be07-340080265ea2", "comment": "Malware payload (Mirai)", "value": "5307dd1641c3110264908a4ba2e63d94", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658399219, "uuid": "8eb176d6-bf4c-48fb-aa65-a9c2fb9aeb33", "comment": "Malware payload (Mirai)", "value": "be20e875bf03acd955c21bab23db194b03bc4d6330ce024f7825150d9c034e02", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658399219, "uuid": "c21df96e-b836-4a71-b470-97dd8efbcb7f", "comment": "Malware payload (Mirai)", "value": "c6a246824bf5ac366b3c67c747f2fe9de16379dd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658399219, "uuid": "e05c9680-de81-4f9b-8381-4068a3bee098", "comment": "Malware payload (Mirai)", "value": "01dbd05119ad28284699012ff0552006bcea5289ecb3f49cbdf3c30c8e4d0deb18aabed6f952c2bb98eb225d63ca48ed", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658399219, "uuid": "77482895-2e1b-4a20-ab53-081e2def191b", "value": "T164A38CDBF64B14A0C8A24BF007CB4FCE3E2362916F6785E33C2E2A7958751CB5905B95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658399219, "uuid": "f365d116-9973-4d61-8cf6-ded2e15d4f1f", "value": "768:yz/kV6y7Id1s9LGoEsnwRc2KPYvIhHFy4/dlltPjQyw07CYIi2gvwk0pn554RZhs:A5MpEiwRmgv8YiDtqeCD7g4k5/LWt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658399219, "uuid": "05008746-07f3-4f81-b4e7-34ba9f785e0a", "value": 99608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658399219, "uuid": "29d0252c-574b-448c-b527-9e55afebcfda", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658399219, "uuid": "bd3f070d-ff1c-4d8e-9b58-ea9095b5ae01", "value": "5307dd1641c3110264908a4ba2e63d94", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a2529a0-08f0-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1658406337, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658406337, "uuid": "3c4ca321-bfeb-4457-bff3-9b890e6b0798", "comment": "Malware payload", "value": "1f47ba7fd131a1a6f7623d76b420d7e9", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658406337, "uuid": "742314c9-f21b-403a-8a49-8887fc4032a0", "comment": "Malware payload", "value": "bf46f4724e5a3b05130df4014244684033feadb1c10d8309b7e3069a4b014a88", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658406337, "uuid": "880c640b-96be-46d4-92ec-b5f2818bf960", "comment": "Malware payload", "value": "07c5e675714a1af618d8eb1f370be12763138343", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658406337, "uuid": "4c671081-48e0-48ca-b7d5-1fa69423aca1", "comment": "Malware payload", "value": "4bd7d54c988be10d3bf92720da4e9066e7df34f1a9f277a04c7c4b65332a4aac9b6c0ce5665c0f29aa9746fdde639a89", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658406337, "uuid": "23eb9736-a442-4d53-b2a6-1b43a3258c31", "value": "T11B5110011BD6431AE3BB8A3557B1A359CB36F961AA638A4D409000C86CAC6109C26F7D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658406337, "uuid": "05fd443e-07ab-490c-bd9f-b46325fda9f8", "value": "48:8lU69DJOtPRRDUKEfREdPEfREdoRq6lal57Xv3y8PYk:8lLDOtPHDfEJENEJESc6lal5v5Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658406337, "uuid": "914822f9-41e3-42dd-84cf-7848114c6771", "value": 2591, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658406337, "uuid": "6c444ae2-ff30-4831-93a7-280ad6eefa79", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658406337, "uuid": "be8af0a7-92a4-4f0c-9155-3ca781866828", "value": "EL Non-Paper Pandemic Resilience final.docx.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b64d7817-0927-11ed-93bb-42010a9c0043", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1658430168, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658430168, "uuid": "50e9ead0-074f-45b1-8e0c-6551a8a479fc", "comment": "Malware payload (SnakeKeylogger)", "value": "f1809b19b801cced4f529617051cd7e1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658430168, "uuid": "ec491860-72ff-4398-9303-4014b3eeec1a", "comment": "Malware payload (SnakeKeylogger)", "value": "c1bff6750d2e97e236ec9af546da99de586e947375ca5b70f2004805786eb262", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658430168, "uuid": "48248de4-1e80-44d8-9f85-d4179ed83910", "comment": "Malware payload (SnakeKeylogger)", "value": "3441a8d5ff463cb34ec22f7646165d0a714ad157", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658430168, "uuid": "4d456f65-f78f-42a9-94a7-58d9a9fe3f87", "comment": "Malware payload (SnakeKeylogger)", "value": "bf6f566c19136ada32171ec2b981818a1ff940cfb0271b19e9efe72fd2264792776a5a848f28c40c76cb8d3ee9df7094", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658430168, "uuid": "f378a2db-6a4c-4f1c-b512-4acaa8028e59", "value": "T18CC3F61D3BF88804E6FF8A7315B15211CBB9F852195ACE1D0AC1F8593A7DA908E17F93", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658430168, "uuid": "d392fcf3-6525-4f6e-972e-9eb19188a5fe", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658430168, "uuid": "8334ef75-26a2-44f4-94a1-a3af55ef84f5", "value": "3072:u5sWO8s1H1CLkZTlXW0K4g+b8oVhwBdtFbY:wmfvPbYTb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658430168, "uuid": "75ba3480-a5cc-4c2a-959c-b492adcebc8e", "value": 129024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658430168, "uuid": "db3dbbf7-5113-4864-b7dd-5be7d7a58738", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658430168, "uuid": "b54c698b-3f84-42f0-9e3c-58ae84d1a6ba", "value": "f1809b19b801cced4f529617051cd7e1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8750713-08ec-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1658404804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658404804, "uuid": "454d4e21-2043-46a4-8af1-9eefba5fef96", "comment": "Malware payload (Mirai)", "value": "381fae0429c2724b9d43551ab948a5e1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658404804, "uuid": "de6ebd34-4f58-47d5-a37d-079bfa3639a3", "comment": "Malware payload (Mirai)", "value": "c298fcdf07d73f2dbfe330ec9050875e11ec1a0d9a54d505fad57424333f3bcc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658404804, "uuid": "1c834f62-e463-48b2-a64e-7491ccf4eb70", "comment": "Malware payload (Mirai)", "value": "817299c289e327e98ff3ed44c951720e018e55a0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658404804, "uuid": "27db3f09-747c-4aeb-bf5e-1a613ff9beca", "comment": "Malware payload (Mirai)", "value": "61661603664b88aae127d7e3d708c194e76a25883fd24d1b16b8e006afed5e33e0a97d38a2d21273660fa6cbe0576776", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658404804, "uuid": "24f3727e-c662-418f-8d50-dc117c90f479", "value": "T11423AEC96DA102CDFFD544B9261D28F94A0FA5238230CC5969F011DF505F29AB2FEEE6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658404804, "uuid": "e066c4eb-1f29-4949-910e-3e3fa249e4da", "value": "768:3OWDpMGrlaPovod+gxMTkq70HV2qb1kfjA2y2Hx1cmGUoKCsHA:7Gcod+8Mod0qu9ROmGUpng", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658404804, "uuid": "5bb0ae82-2838-4be1-a419-51936109642f", "value": 46708, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658404804, "uuid": "7d8abd4d-c663-40a8-a98a-00fad33244fa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658404804, "uuid": "768433ed-3857-40d2-8b65-8ca9c850fec6", "value": "SecuriteInfo.com.Linux.Siggen.9999.30232.832", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5862797-0945-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1658443052, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658443052, "uuid": "e4ce0d0f-6dc0-4ab5-b5e1-10362dee8b4a", "comment": "Malware payload", "value": "76780a6fde5700d74fe187bbf2064e65", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658443052, "uuid": "a17d5f44-77e5-430f-ba93-e5a169910444", "comment": "Malware payload", "value": "c3a1e3e128a54d44e9cc9d1e5d1e1628b7c20200aec86d0c06cb3fd719ec34f8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658443052, "uuid": "8335e397-6475-4995-a7ed-ca8f993820df", "comment": "Malware payload", "value": "b352e6611aa8d32f6820bca364e8acdcab7d096f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658443052, "uuid": "fcdf535c-dfb4-4640-a0cc-0048b2a7ec3e", "comment": "Malware payload", "value": "73226a6ac5ea33b27914a5a750645ba69f357de2447b0b2896cc38f6f7d8891c71d8437233806c1f93e01bf24a5cfba7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658443052, "uuid": "56cae647-3e0b-4d0b-aa40-2fbf36e0e8cf", "value": "T1EE2502117504D093FA28077699BBC67617AA7E9BBC444A9F3348BB8F31F2B05901BE1D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658443052, "uuid": "4b0d5f28-8172-4f6b-932e-1cc3b7f917e3", "value": "f10e4da994053bf80c20cee985b32e29", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658443052, "uuid": "56204c1c-a1ef-4bd6-8c44-9dc589caa44d", "value": "24576:6O1He6jMQvSAGkRBRDl0AYOgHSIXCgjXcOCVX92:19jMmfh0bOg5xX3iQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658443052, "uuid": "3acbb8cc-9f1c-4c73-be51-e1d1fae2a8f3", "value": 980770, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658443052, "uuid": "320708aa-db2d-4096-9981-69d1d02112ac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658443052, "uuid": "53941a3b-abce-4796-aa57-54f48d77257c", "value": "SecuriteInfo.com.Gen.Variant.Nemesis.9233.9594.12699", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25cd5d13-0932-11ed-93bb-42010a9c0043", "comment": "Malware payload (Gafgyt)", "timestamp": 1658434650, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658434650, "uuid": "6a64f60a-3393-4be2-a789-b965bb555f71", "comment": "Malware payload (Gafgyt)", "value": "f1bba4afcb260b7684b470be61d8e00c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658434650, "uuid": "a4985abe-af4c-410f-94a3-f0e4b8a51148", "comment": "Malware payload (Gafgyt)", "value": "c6227c58fee080f4fd4cec035d91ffc6818764cda1cd8ca50dcbf4651da3a917", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658434650, "uuid": "56cd7536-baa5-4c57-adcd-7f8089b8dd83", "comment": "Malware payload (Gafgyt)", "value": "32c90c61aefc7f2a14199933b34fc8548fb838d9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658434650, "uuid": "77c4b920-bf30-46e1-bf26-a37d6828381f", "comment": "Malware payload (Gafgyt)", "value": "c25bb3f00ecc18074e0b35dd23eb2def2533019d1b17972106d55d1f54e92ff3251d837a5f372ff44400944f8eee80eb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658434650, "uuid": "6dc9c376-c98a-4e3f-96e6-0743f672a051", "value": "T150933B96E742C5F3C4430BB2019BAB690931B9BB0A2B9E46F71D6CF0AB134C93125F95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658434650, "uuid": "ce0ae46a-4d45-4543-ad06-ba0c34edb564", "value": "1536:7PNIIxmXovN8vSW6s54s770AFKoLFuMNWWW/ZlQgnPYmL+bVOP43XfppG:7mXovN8b16s770wKOGbQIYmKbVOPSXf+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658434650, "uuid": "e3c20260-4626-4cfd-b219-c3e9a2ca9cc3", "value": 89429, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658434650, "uuid": "72e59751-aa2b-4beb-9f22-ae49a4731191", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658434650, "uuid": "553ff4e3-0f65-4bba-8d7c-1534ab227cc6", "value": "f1bba4afcb260b7684b470be61d8e00c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a279131c-08cf-11ed-93bb-42010a9c0043", "comment": "Malware payload (GuLoader)", "timestamp": 1658392339, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658392339, "uuid": "09fc29dd-00d6-4a6d-81b8-6c6c3a0cc592", "comment": "Malware payload (GuLoader)", "value": "2bbe09a384f67325c9c34aaf51d58ce2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658392339, "uuid": "7b60d157-b72b-4413-996f-2ace3941755f", "comment": "Malware payload (GuLoader)", "value": "c6426dd4d5be02181a81736ba1dcbb89b0f35ff8b1519406f36cb5133c76ddf4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658392339, "uuid": "85291512-cb76-485d-99ea-6578358eb9f7", "comment": "Malware payload (GuLoader)", "value": "a79c136aabefe0ed836142f9c624f520492d5e08", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658392339, "uuid": "c3dee3b0-41c0-4b9e-b3cd-e28e7db5764b", "comment": "Malware payload (GuLoader)", "value": "a758201bebd978ec63a9aa22e303629c1c52086ef6b8e2c4415cf0d457eb57fe34db3e6a67e86fbd2f6e54fae9617ada", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658392339, "uuid": "95cd7685-e022-4689-adc6-6c1e92a06a6f", "value": "T185649E256B5ACD03E2D215F089B3E3B977768D51162B82578BD0FF1B787C3D22E09262", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658392339, "uuid": "240f417f-be96-4722-88f7-ec78bdf813eb", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658392339, "uuid": "f40c9ae0-e5eb-422b-a4de-123200dde31a", "value": "6144:PYa6bycnHpTVQf+6waJQegA1mOl9RxHBJbswb:PYJy4H3Qfv3gAgObRd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658392339, "uuid": "6b7b19da-9b39-417b-9720-e0048850c722", "value": 324760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658392339, "uuid": "8dd7810c-ff93-4af3-8e56-c24be6ca0229", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658392339, "uuid": "76f49b2e-de67-4ad9-ab4b-6f22893e127e", "value": "SecuriteInfo.com.Gen.Variant.Nemesis.9244.3096.17053", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91f954c1-08be-11ed-93bb-42010a9c0043", "comment": "Malware payload (XFilesStealer)", "timestamp": 1658385010, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658385010, "uuid": "7fd6ef6b-0c4f-4feb-9544-d66267c5053c", "comment": "Malware payload (XFilesStealer)", "value": "1b394ca621cbcd4a4d55275258240004", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XFilesStealer", "colour": "#D1E15B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658385010, "uuid": "4a2ab980-b382-4f44-b02a-e15bb35f6df8", "comment": "Malware payload (XFilesStealer)", "value": "c69decc448626e1aa6652d4a6e86899649eefd30190ff83d93f0daf36630e376", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XFilesStealer", "colour": "#D1E15B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658385010, "uuid": "87fcb58c-a1e7-4bdc-aee6-2fac839f934d", "comment": "Malware payload (XFilesStealer)", "value": "f40e5efb57c0d7ef89b26cfb9b9a9babac4bce11", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XFilesStealer", "colour": "#D1E15B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658385010, "uuid": "d015094a-73c8-4660-94aa-699205043706", "comment": "Malware payload (XFilesStealer)", "value": "f80ca4acd81c36bbe95aa2355222aaaef387651b5ceb9ddf303d40d9d77d30f5fe77d9e393d893af02abe59bb1a3b319", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XFilesStealer", "colour": "#D1E15B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658385010, "uuid": "8d011811-eda3-4ccf-b545-a78e6565ca4f", "value": "T1944622262F02D75EC6C4F6F46A122B84CA62FD583DEBCD2292F1A71D48747D421AD42F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658385010, "uuid": "8239a9fd-9916-499d-bc46-7d5a9a72889a", "value": "98304:mROVCeYU95/+o/nxi+bPK94uKwb+E85KDuyFGE9t5mPk1qdT:mgVCpU9fVbq4rwnDwERms1qd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658385010, "uuid": "f0ab160f-ac5a-4384-b952-368819fd5a06", "value": 5548544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658385010, "uuid": "23723ebe-b960-4803-853d-6bfc0ce7cae7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658385010, "uuid": "c90c91da-00bb-4d67-8d00-b7e928650951", "value": "1b394ca621cbcd4a4d55275258240004", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48652c26-088c-11ed-93bb-42010a9c0043", "comment": "Malware payload (RedLineStealer)", "timestamp": 1658363412, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658363412, "uuid": "cf447b50-543f-4d63-a068-bd3a94f905fb", "comment": "Malware payload (RedLineStealer)", "value": "1c9bac6d3ee22e77ebdf105515ada5e1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658363412, "uuid": "9601501f-0977-4b0e-955f-ebf6ec6926bd", "comment": "Malware payload (RedLineStealer)", "value": "c785dfc13013ed4dea0af0d184f0bc12f5588c0286655c4a550daef994557867", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658363412, "uuid": "fd4790f3-30a9-4e54-8c93-f1c48e73dc64", "comment": "Malware payload (RedLineStealer)", "value": "6aac6767fbefe2b1d35957bba16bf91e04e50cd8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658363412, "uuid": "8a257173-f3b8-42db-97be-46da9f1c611d", "comment": "Malware payload (RedLineStealer)", "value": "9e3054343d25bb62379fcd2401aacd56bd738c59f7c15613a942f44340d37971604fc615db2dc1114342701c6222fe03", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658363412, "uuid": "5d659591-4adc-48fc-8b38-a8e25abce560", "value": "T16784C010BA90D035E1B722F449B6866CB93E7EA16B2454CF22D52FEE57346E1EC3131B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658363412, "uuid": "2de3ee48-b327-4f92-800e-f7f87ca225ff", "value": "976d12f8d334d9267ea345a5cd4e901a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658363412, "uuid": "a2f1eb3d-8a19-4c1e-a1c2-925091358911", "value": "12288:INMmjtUZJYPat5MPRB6VuWnfUw3ogOnA:8jykPGmRHWswYgA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658363412, "uuid": "fc44bbde-f906-4957-9960-113220ef5b53", "value": 403968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658363412, "uuid": "a40fe335-c4f0-41e6-bc0b-7da86809e4ab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658363412, "uuid": "d4f1ff29-c256-481c-a1fe-a10c3aa1ebc0", "value": "1c9bac6d3ee22e77ebdf105515ada5e1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b55fedb0-091b-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1658425013, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658425013, "uuid": "acc0aad5-06a7-41f7-a09a-77b2d186150d", "comment": "Malware payload", "value": "d3c047dc453f70b811090acb62601c3f", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "iran", "colour": "#114712", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "phishing", "colour": "#6D4B87", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SmsSpy", "colour": "#EFD783", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658425013, "uuid": "56681a98-c320-483a-be3f-8b403ca20553", "comment": "Malware payload", "value": "c8bc280e101a917eab5c0d407035c9f9d3a0486db97a5ccb7729c2d2a0a0b40d", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "iran", "colour": "#114712", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "phishing", "colour": "#6D4B87", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SmsSpy", "colour": "#EFD783", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658425013, "uuid": "cea04b8a-8bcd-4c11-b100-3ffe9e276a6e", "comment": "Malware payload", "value": "e7a9839eee8c3e9be24a72428d7d91fbe727dd88", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "iran", "colour": "#114712", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "phishing", "colour": "#6D4B87", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SmsSpy", "colour": "#EFD783", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658425013, "uuid": "0c18e49d-9526-492d-8999-f6ad91bc0aaf", "comment": "Malware payload", "value": "a4cacb4a4e29dea11f969285259c5668e7404fda333f8466d2cab086b3ed368cb82d0e0c28e173655bbe8a50d5e0159b", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "iran", "colour": "#114712", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "phishing", "colour": "#6D4B87", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SmsSpy", "colour": "#EFD783", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658425013, "uuid": "0d7cd505-8def-4f8a-b4f6-edfa67a985c8", "value": "T145A51253F366E62BC876D0732546173290168E08CA47BB8A3905B7FD28FBDE84F562C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658425013, "uuid": "203f52f8-0807-47dd-ac74-0b317492e2e4", "value": "49152:ZbmynM4+49hwSvVwhq0QlImytU5mo6jLuGFbNUp4:Uynj1d9wesimFvuGFO4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658425013, "uuid": "04c9937c-d807-4c16-8d23-97cad5f36515", "value": 2138989, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658425013, "uuid": "c686c0ee-7d93-4ca3-b2ac-2439ddf4729e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658425013, "uuid": "ff25e859-04a7-4631-8800-aab93bb9063f", "value": "sana-2.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "200ea37e-0929-11ed-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1658430775, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658430775, "uuid": "92946b86-4448-4e9a-8b86-0af876c53654", "comment": "Malware payload (Formbook)", "value": "06772990da6bc9aeb27ca362a3842d4f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658430775, "uuid": "7278d87f-0ab2-4d6f-b674-89b6a5b1f060", "comment": "Malware payload (Formbook)", "value": "c9f25a48b6617a8dd5936c04dabb1e260bc46dc2284bb228885755d3ec7622bf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658430775, "uuid": "f5cb3192-67ec-44aa-9fd2-dd95ba960ef1", "comment": "Malware payload (Formbook)", "value": "d7ff88c8ae542c63b3e7d8ad99f86ae1592ab820", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658430775, "uuid": "b5845273-a296-49f6-8b6c-f776f96aa98e", "comment": "Malware payload (Formbook)", "value": "e87f39eb5e883e0dbd39780289aa0cbb216c921a408f6608b81d0667409f47c2feb64b30e646f25644023f72682091c2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658430775, "uuid": "612e198d-1af6-4788-8fcb-f080200d1a0a", "value": "T19C05123771F5FB50C97853F201636A480AB2321E7134E6AE2D99F5DA88E4BE499107F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658430775, "uuid": "954f6993-0c4a-4c4e-a61b-cc2d50eb337d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658430775, "uuid": "87c0a2f6-5711-4153-b788-c1f26bd7488d", "value": "12288:2sNGVQMRE5bGyFv2pa3X5IbRbK18Fo+2QJzOPvgFmjTQmfYRx8c31h:z0REmSD1MoCyP860xj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658430775, "uuid": "57fff5a5-b235-4be0-ae03-9f51cf772f33", "value": 864768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658430775, "uuid": "38c6847d-0e63-4bf9-9b44-650f18b0d37f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658430775, "uuid": "2d0a7d96-1c56-4645-a18b-b93af9b01306", "value": "E-dekont.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56173bb5-090d-11ed-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1658418840, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658418840, "uuid": "135dc326-c244-4709-a781-48cc64b1a3a1", "comment": "Malware payload (Formbook)", "value": "7d02f24302c91e48b5f51807d948ed6d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658418840, "uuid": "f126c43a-c03a-4320-89fe-042b09a50765", "comment": "Malware payload (Formbook)", "value": "c9fd303e6128a5ebf5bde39ed2cff678d65fda943fc9df26c8475ebca174bd55", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658418840, "uuid": "2bd8dac0-ba42-418a-a14b-b11276f57ff6", "comment": "Malware payload (Formbook)", "value": "41c8f4c5e35faa9042463bf64df3980e6dc4258e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658418840, "uuid": "7a4e941f-7a70-4f48-9f7d-230f6e1a2553", "comment": "Malware payload (Formbook)", "value": "902d55bb58d629b5d0ff21061c2ec75ffb9698f3b41148c481af6f553d0191694e71d87d0b7c724b11573a24626fa696", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658418840, "uuid": "30817169-5a95-4e15-a84b-2d190b2b6260", "value": "T1C9A42374B0146C26ED705FFB1C66B68537697B6EF01D8EAC2E238522B50180B1BF1AF5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658418840, "uuid": "2db43734-f12b-4719-9fc0-3b0e98e50900", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658418840, "uuid": "3b0128d3-5fb6-4db4-b1b2-585ea3469f09", "value": "12288:by0SxsuACHXBHgbGH59QL1nR4PnI/xTu:byjlHXZs3j4PnI/8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658418840, "uuid": "14ab454f-ab0b-4b5f-90ac-b8926b57a8f0", "value": 476160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658418840, "uuid": "49d04986-f1a4-4786-832f-144d8cff6a49", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658418840, "uuid": "de015057-2720-4f24-bbfb-b64b47b2a67f", "value": "skyrunbeairxz.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1b21134-091c-11ed-93bb-42010a9c0043", "comment": "Malware payload (GuLoader)", "timestamp": 1658425490, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658425490, "uuid": "2455c73b-a8d2-4896-8204-15d91e34dae6", "comment": "Malware payload (GuLoader)", "value": "3f5fcc32fa3bf2ef37c1327fd4bed1ab", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658425490, "uuid": "a716be2f-71ed-4a97-860d-f5bed5d308b7", "comment": "Malware payload (GuLoader)", "value": "ca499c1b316919235813adde98b14403b114791d70ea2c1fceb25a576ab097eb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658425490, "uuid": "3af6301e-edd4-4a18-969f-3475d26ceb7f", "comment": "Malware payload (GuLoader)", "value": "1e3dcd9779cfd8480cfb3387c208c09be0b984bc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658425490, "uuid": "ce56f159-aef3-4423-a548-0d25ef0a709a", "comment": "Malware payload (GuLoader)", "value": "7ac95ae951e2d15d9451184ac05f7bd2ba1a164f5aa7bae5fcd0270d465257432049e8fe1f7db49fb27c62f73440cae4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658425490, "uuid": "1d08e237-424b-4a1c-8aaa-5aa410f30501", "value": "T12425F133214E244DF51D63348150A6F74765FD2324AA8CCF3BA5344AEEB8BD3B938669", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658425490, "uuid": "c78c86c3-015d-4d3c-ae07-75e3306bfb31", "value": "5f0c714c36e6cc016b3a1f4bc86559e4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658425490, "uuid": "e1275595-2dc3-4083-a2ab-05bc2aaa91e4", "value": "24576:a9KM3/93M6caQmfvmWSH1YvgnMu1xygATZ0wNrcMfcVLCn:KV3MnaQSuxHeiT/yTZnZH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658425490, "uuid": "781c075b-04ab-43a6-9851-d9dc5d4e9e08", "value": 964040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658425490, "uuid": "037fce91-a007-4046-8e60-6476f1c25ceb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658425490, "uuid": "ac2f0e23-5244-4a61-90ce-172c32cb793a", "value": "3f5fcc32fa3bf2ef37c1327fd4bed1ab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "551b75cc-0923-11ed-93bb-42010a9c0043", "comment": "Malware payload (IcedID)", "timestamp": 1658428287, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658428287, "uuid": "0aecb276-6de7-4b96-b08b-db62c349b6dd", "comment": "Malware payload (IcedID)", "value": "aebe33e3c0d5c257c9a0ffb17a4db5b3", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658428287, "uuid": "83d438f4-cd35-430a-b952-56aca506af3d", "comment": "Malware payload (IcedID)", "value": "ca51683ba95948fea25f05549ead2ca86539aeed69e09fd6cf70a0d03d2808a0", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658428287, "uuid": "e1862f41-a716-4cf9-a326-9e84a2c083f9", "comment": "Malware payload (IcedID)", "value": "f2e506d369700a68f8ce48b8d5cfbb879c1e6f1e", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658428287, "uuid": "0cdc95d5-7081-499d-918e-8123f73b7b58", "comment": "Malware payload (IcedID)", "value": "5d1fa8e2349bb6ff5fc49c561f98d1078ce8d8e3731db2cb3454f3f1cec72074b4ae3a3a26e485b1ad3a82a470f7db4c", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658428287, "uuid": "8e486aae-48b3-4648-a203-d12c3603c3e7", "value": "T16A75F672A2C01017C22292F295267F4CBDB3D537DF5A8A8173BC16BE5FE2E50E522B51", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658428287, "uuid": "7c2c8d83-eb62-43bf-8a92-0e9f6ee7a168", "value": "3072:08s75HoCqDhCzPfEn9XWR8iIGqlZmJRsGL:KoCqDhCUiIVMR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658428287, "uuid": "1ae8acab-e99f-42c6-9138-3345d47332d8", "value": 1638400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658428287, "uuid": "401d222d-4365-4fd8-a4af-30972ad5726c", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658428287, "uuid": "56c639a1-df94-4ea7-867e-e435de5136b3", "value": "July-21_Invoice_100_document.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c0136bd-08f9-11ed-93bb-42010a9c0043", "comment": "Malware payload (Gozi)", "timestamp": 1658410287, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658410287, "uuid": "83cae3da-a0b0-4e15-a0f9-3dc8dced2d02", "comment": "Malware payload (Gozi)", "value": "c2bcfb37a8168471fc05f34ab66a6bed", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658410287, "uuid": "ffc9d874-37bd-4cc4-8282-f096763a8cb6", "comment": "Malware payload (Gozi)", "value": "cb2cf7b9518dfe993900298d2e687582042db4b3996b84d22844e54b30d2cba0", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658410287, "uuid": "d58a921e-ee13-4e15-8e6f-ca4b74a39d04", "comment": "Malware payload (Gozi)", "value": "fc57c63c6b098ef08ee9c01156d4d786f3429582", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658410287, "uuid": "3e5c4b23-6805-40c5-9805-f0a620a42ea3", "comment": "Malware payload (Gozi)", "value": "105528622afb59c71ee9d9c032952e1dc92bb6d7cca76a729528ce2dbc65348df4cc86a1f513fd407f1c1b82551a82af", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658410287, "uuid": "61d6af8a-97ca-4640-a104-ac692a4f3e94", "value": "T11D05AF93F3E640BEC0AB92718E12671BEBF1B80A0234D74B57D49EA56F13B61671E311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658410287, "uuid": "12fe1327-25ec-4ac9-9b7c-81241114b893", "value": "5fbc67723ebc3eef89d6d09b0a9e2267", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658410287, "uuid": "bc20783f-5195-4990-81ed-059180538756", "value": "24576:j1tOqru7D5xqQi+NpMIcFQ6gTfwwgZXysYp:Rtdy7D5xq4N21ZOwwgXTY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658410287, "uuid": "ec2647e0-3a5d-4eb3-a56f-399d2e7df5bb", "value": 803752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658410287, "uuid": "39e6fb33-af4f-40de-a88c-85899b52d339", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658410287, "uuid": "2439b2dc-692c-48ca-bda4-0a5e4b608cbb", "value": "105d5c58.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a667551f-08c0-11ed-93bb-42010a9c0043", "comment": "Malware payload (XFilesStealer)", "timestamp": 1658385903, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658385903, "uuid": "c79b9b82-9d15-4d1e-97d1-725372ed6c61", "comment": "Malware payload (XFilesStealer)", "value": "7535ecd9e2541119dc2e0e28a3c2c8be", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XFilesStealer", "colour": "#D1E15B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658385903, "uuid": "b39f3293-e501-499a-a594-42470dcf66e0", "comment": "Malware payload (XFilesStealer)", "value": "cb9f6a586900f965180965a61942b817300dbc6844d5da7fef7e5f9064b88c65", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XFilesStealer", "colour": "#D1E15B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658385903, "uuid": "23b5f8c0-a4f5-4264-9400-00ffeb3efa44", "comment": "Malware payload (XFilesStealer)", "value": "90ef98b76d60e0003199b282f2f94f6b577a40c7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XFilesStealer", "colour": "#D1E15B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658385903, "uuid": "98c39964-6a78-4457-9f8b-4a83596ae9f8", "comment": "Malware payload (XFilesStealer)", "value": "46fd3b0b80e2d5358a430063a0751ecb3283e4b891bda7051609b164843981cf2c0ccbb72213e68dc52b705a4bcc31d0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XFilesStealer", "colour": "#D1E15B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658385903, "uuid": "5737c43d-3fb0-4f0c-b570-10b4e33afa62", "value": "T1E44623162F16C749C2C1FAF97E62AB90C594FC987DEACD71A2F1661D483A3D0212D42F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658385903, "uuid": "482e1b03-9ee4-4cff-a90b-5d6a9443676e", "value": "98304:PNT+LgVhp0qpuwMUJup/YEyEmTgjY918FFHzpeRZ6Z:PNaEcqpTJup/YfEIDeFEaZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658385903, "uuid": "5d723a58-11c5-4d4f-ae6d-123f8dec2387", "value": 5548544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658385903, "uuid": "f9f889f7-ceab-41ae-8caf-6ce8f1e9eb7e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658385903, "uuid": "ffccd588-8e40-462a-a243-240b53d6af5d", "value": "7535ecd9e2541119dc2e0e28a3c2c8be", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29ba4aaa-08ad-11ed-93bb-42010a9c0043", "comment": "Malware payload (RedLineStealer)", "timestamp": 1658377534, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658377534, "uuid": "caf597b4-1864-4a05-a460-48d411b6d97a", "comment": "Malware payload (RedLineStealer)", "value": "89e894f7df4017c3cd6f92a1b9d9b6c1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658377534, "uuid": "6f29abad-fbb2-4d1a-a826-eb50f4023674", "comment": "Malware payload (RedLineStealer)", "value": "cbabac9e2487ea63330c9bfa6ab55594f0a4fb0de7370b97f74cd62e2c72923e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658377534, "uuid": "a519dd0b-31b6-40c5-a0a1-decd24a48ab3", "comment": "Malware payload (RedLineStealer)", "value": "943d7a3a3fbfa94764c7a3963f6af750dd389291", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658377534, "uuid": "2cdb8a71-8e90-4c64-a674-97eca7bd13c2", "comment": "Malware payload (RedLineStealer)", "value": "ea358d0f0beb585a14ef7203233a63b877553e8e2e04e0e80c3253c7b3d7a90dedce53f632a46958708c8b52a66cec70", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658377534, "uuid": "3d573ec0-4d46-4325-8aff-8cf1f95c7306", "value": "T11054F11073A0D87AD1A32131E4718BBE5A7E75B26675858B37603B2E4E703C059BB3B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658377534, "uuid": "8a213fba-36ee-45ff-85d8-bb8a06727dad", "value": "085db6b068e0ab532921326907b886ab", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658377534, "uuid": "14ffffd1-5ad6-4efc-b5bf-534823b94603", "value": "6144:gzaeeCGa3voF1EPHsIAftYzVmhry2vE8L4e4Bs/2z:gOjwUEPIyaPL4c/2z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658377534, "uuid": "9067c1c0-e838-4da6-9ae5-829513250410", "value": 296448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658377534, "uuid": "98cc3220-3a8f-49d2-993d-82af085e5adf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658377534, "uuid": "512cd6dc-2eb8-45f6-9262-a071d2af3f0c", "value": "89e894f7df4017c3cd6f92a1b9d9b6c1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e697a2d3-0948-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1658444422, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658444422, "uuid": "0d020ff6-3c5a-48dd-a965-a4168e57b975", "comment": "Malware payload", "value": "e8fe243f577bc2a31aa798bbea27e360", "object_relation": "md5", "Tag": [ { "name": "CL", "colour": "#5EDEA7", "exportable": true, "hide_tag": false }, { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658444422, "uuid": "c7de48a3-5d8d-465b-bd4a-b15b086bb353", "comment": "Malware payload", "value": "cbdd6240299ef63474c57eb45fe18de37f85dbeb26aae327556a245379e13304", "object_relation": "sha256", "Tag": [ { "name": "CL", "colour": "#5EDEA7", "exportable": true, "hide_tag": false }, { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658444422, "uuid": "4df836c0-24b6-494c-8670-819041d729c6", "comment": "Malware payload", "value": "607ee55bdb17963f976b90961fa12416e41f5c36", "object_relation": "sha1", "Tag": [ { "name": "CL", "colour": "#5EDEA7", "exportable": true, "hide_tag": false }, { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658444422, "uuid": "d696c78d-ec28-452a-947d-43365f4bf580", "comment": "Malware payload", "value": "9d8c157db6c82f09f071ecd7e17191e629f450063a30c291e8cf93f5bd5a1901113522bb1ae247bc8b8cce19136be877", "object_relation": "sha3-384", "Tag": [ { "name": "CL", "colour": "#5EDEA7", "exportable": true, "hide_tag": false }, { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658444422, "uuid": "5061a2d7-43be-49ce-8304-38c945d2998c", "value": "T1E325338D5D56AAC2CD833395DBF69AC9FA8219520C436C9C87137CC58F2139382B97F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658444422, "uuid": "1adb9c16-17db-48a4-8454-56737ffbedd1", "value": "24576:uA1lQYX0gkUei1OaMVfr7iaS8LC36Cw3fQvzw/M1ffJc/O/:z1lQS0ghb1kVHiv85Jon2g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658444422, "uuid": "93df32b1-0add-456c-994e-a3de8cb25185", "value": 1014034, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658444422, "uuid": "c368f03c-941e-4eb5-a66b-69e0a3663a0c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658444422, "uuid": "c0f10d7a-7a1d-4672-b09e-d7df2e1f1916", "value": "medonho02.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbde9174-08be-11ed-93bb-42010a9c0043", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1658385134, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658385134, "uuid": "c849251f-f3a8-4a9d-8659-bec9c04f0012", "comment": "Malware payload (SnakeKeylogger)", "value": "e75c6d28646abf762df63e20a8165095", "object_relation": "md5", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658385134, "uuid": "0a4d41d2-81b1-4de3-99a4-96700f2decba", "comment": "Malware payload (SnakeKeylogger)", "value": "cdb1bacb7d0767664faa5f77d8954419ec33ec1a6902f21830c9487ab2ef229b", "object_relation": "sha256", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658385134, "uuid": "589345d5-133f-419c-9ad3-8fd8ec89aade", "comment": "Malware payload (SnakeKeylogger)", "value": "1115f3bab8c3828d83a9f6684b0bc1ee2ea6f715", "object_relation": "sha1", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658385134, "uuid": "206bd1b6-fff4-46af-a362-a2ef5d1de54b", "comment": "Malware payload (SnakeKeylogger)", "value": "397c58a405636f675d927f115fc7850f0539dd536f972562602912a1e6f9921f8dc8184a956a12049d8c06cd776a5ec6", "object_relation": "sha3-384", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658385134, "uuid": "0ef33d1c-3332-4ee0-89d7-c4fdc276a62b", "value": "T112F3129837D378B2F8940B7A3525844D2454BEB0A8B6114BF480F5CE98B3EB5D2486FF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658385134, "uuid": "83fd00ec-d64e-4fbc-97ee-61d185130557", "value": "3072:zOlLSpNUqPIROz8D4uympbNRz8rkhEgLrJ7Qi2YW/2EAGke2jp:VPIREjcbjhEsWu3GkVjp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658385134, "uuid": "17baae32-a874-4362-aee0-060183e0e1bb", "value": 160232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658385134, "uuid": "d22d6ff4-31f4-4283-9b3a-89bee52e8611", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658385134, "uuid": "105cab56-e403-4e94-bfd4-46694be25fca", "value": "Payment Swift.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c134f638-08c0-11ed-93bb-42010a9c0043", "comment": "Malware payload (AsyncRAT)", "timestamp": 1658385948, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658385948, "uuid": "3989192f-e370-4d98-a67f-f9b84de93c8c", "comment": "Malware payload (AsyncRAT)", "value": "04f81cd3a595c95b20c258a514118388", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658385948, "uuid": "32a7a6d2-8b9b-4b9e-9bdf-ebf9463c18fc", "comment": "Malware payload (AsyncRAT)", "value": "cdfb3a8ed030bb040835d4e2d5fd150bff61006971ce84809183127fd758639a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658385948, "uuid": "36453eff-f044-4302-a3ef-e9f7f6d297c4", "comment": "Malware payload (AsyncRAT)", "value": "30e11f854dfecbd170ac0c5286ed75ffa1f48d86", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658385948, "uuid": "aaf0ae67-b745-4f1d-959b-4320a5dfd675", "comment": "Malware payload (AsyncRAT)", "value": "0142a4b6a01ed725036570cf4f6ab5d66f9b605066d66dd680ba9155a85c649e5e7f9dbd9e27e24ebfee205a7cc65383", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658385948, "uuid": "eccc838e-e0d0-457b-b69c-2e3e1806c7cf", "value": "T124D418262F16D749C6C0F6F86D12AB84C5A1FC583DEACD31A2F2B62D89357C0516D82F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658385948, "uuid": "bb462760-fd4c-483d-8dea-abdf59b0e9b6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658385948, "uuid": "45414e3a-d9fb-49c4-8835-6a68ebafaae5", "value": "6144:l/Yprz9pQLYJy6BzahC3Ic2TD2mo9txBPRLF:1mH9EYA6RJ4c2nkxp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658385948, "uuid": "5b8d82ac-4ba3-44fc-95ae-1138b7a4a643", "value": 621568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658385948, "uuid": "20dcf42d-830f-47d2-9786-3c03ba1b661b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658385948, "uuid": "c8e716cb-bbc6-4bbe-86a9-0bc9d4f60db7", "value": "04f81cd3a595c95b20c258a514118388", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dfda13f0-08e6-11ed-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1658402320, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658402320, "uuid": "15885c39-9a1a-415d-ac74-69e78686807c", "comment": "Malware payload (Formbook)", "value": "1141f22a44a0273f601f2039a7bf0c4d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658402320, "uuid": "7d5bd03f-ee70-4694-9cd6-a9f967de580d", "comment": "Malware payload (Formbook)", "value": "d08018283cf25fd53c024909910f8756c6d0cd3db2a1fdc19e2591f6fe03b688", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658402320, "uuid": "d7f2278e-b745-4c7c-8d14-0d862319deec", "comment": "Malware payload (Formbook)", "value": "e14011f13534da76d3ed00fcd15f29cc2e2618df", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658402320, "uuid": "8bce0d91-1a26-4058-8b30-569b01b6c42b", "comment": "Malware payload (Formbook)", "value": "026c42ac6ba2c772be2f7b8ea7b52c7436336323a66089abdaa07f6a512387d05634c679376448efbb3d81212fccd509", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658402320, "uuid": "d2d417aa-5bfa-4506-a8e5-387c7207f678", "value": "T17E04AF36E742C034E2B251F5B26D1B7B883E1D343254A0AAE3E11AE56FA05E5F43971F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658402320, "uuid": "dd02f427-9b9f-4fa3-8613-c51351276af9", "value": "3072:T9J9E3Y/zxtjUEJBWUPFaOtqzTjTnfELyBDN9m02lUaPI+yJqJ9XnrybnoiHvxmz:63Ybx6EJHaO4zfjsGBh9m/9PzlJ9XryW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658402320, "uuid": "995d7394-0a23-4f06-b0b8-d6d70cd3c9de", "value": 182784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658402320, "uuid": "bc199fed-e16a-4035-80ad-36b74ed8ea7f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658402320, "uuid": "ee307021-0fd4-4abf-afe5-26bfa8c4322e", "value": "1141f22a44a0273f601f2039a7bf0c4d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13207309-08c7-11ed-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1658388663, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658388663, "uuid": "87388b98-f6bb-4b05-b4cb-08e2c6256c6b", "comment": "Malware payload (AgentTesla)", "value": "062d5b11c725c34603a821192499865e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658388663, "uuid": "76911d31-ca6f-4241-a327-116161b07c1b", "comment": "Malware payload (AgentTesla)", "value": "d17d166ae1696d97e380a008f1eb7cd1942c38c2cd88a218aa4b1eff502985d2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658388663, "uuid": "8802be62-236b-4af4-b261-89ff106f3487", "comment": "Malware payload (AgentTesla)", "value": "e4a978dc7d846d6e3c9cc252634a810c56a119e8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658388663, "uuid": "306b1f64-513a-4e4a-bba9-d29b886d9fc9", "comment": "Malware payload (AgentTesla)", "value": "4db26b2d47eae7fcb738b068a95341fa80245744abaace70c8579f3ee232308e1da745ee36f6bff043d5d13130bd61d0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658388663, "uuid": "75a661be-3bec-4c2f-8595-5d14678ad1c6", "value": "T1BCB423A3A670F76DAB538111C75F84BCE77587A0FE04DEEF95ACA217D82862C074A710", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658388663, "uuid": "61b491a8-ace1-4a7f-abb3-6f5be61505d7", "value": "12288:mO8Wl4RDC6EMvk5Jt/PyVeQ1IH2zAsYkC68ef/3Xh0:0IIk5//PQHzAs9C6t0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658388663, "uuid": "209a01a2-4b49-4d06-8c22-b9bee6cde3a4", "value": 534920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658388663, "uuid": "5eaadece-f2a0-42d5-bbf6-b03494808f45", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658388663, "uuid": "7946d35a-c076-4a01-96e7-8b44997a7730", "value": "PURCHASE ORDER.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3fa1b8c6-08f0-11ed-93bb-42010a9c0043", "comment": "Malware payload (Loki)", "timestamp": 1658406347, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658406347, "uuid": "7f0b4e38-0f05-4141-b045-829fd10e0c5a", "comment": "Malware payload (Loki)", "value": "883081080c781669acab831412d34a2a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658406347, "uuid": "c894e03f-75f9-457f-a15b-08bfeeb6b339", "comment": "Malware payload (Loki)", "value": "d18c6f7496f569ff77ce5a6f8c4985e204f53687f383d037742fdc4c3b9955e6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658406347, "uuid": "703b7c1d-5952-4b72-a107-4aa9c6d876c8", "comment": "Malware payload (Loki)", "value": "bb170879e165039eb12cf4dff6753d942486b541", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658406347, "uuid": "50f141c3-7808-4864-9c06-6e75d598bd23", "comment": "Malware payload (Loki)", "value": "b43d63b34e3f0f3aec255bd3272283f17bc991987f2059e61a5eef2b4d7a4d0872993d4633b01fa7e5ac31bdbdc0088d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658406347, "uuid": "c020501c-8e21-4323-ad4f-2cba9558d72e", "value": "T1E4D4BF197627DD13C27803F6C4C2604893B18606E22ED7C7AECA62D71B437E69DCA797", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658406347, "uuid": "2712cee3-a10b-4e00-9972-8926eb759b10", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658406347, "uuid": "2e30acab-103a-4c43-99ed-aefdb0675b37", "value": "12288:mrXyKpYeg31h3VJWYK61IxvBLuTUNA4u+Fy/elSp7:mznM3TlRIxJLdNNFUe0p7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658406347, "uuid": "c967fa1b-7266-4448-a746-c1a7082df266", "value": 647680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658406347, "uuid": "2c4b53cf-65c1-4667-8b10-cd49af2eb580", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658406347, "uuid": "120bfdf5-fb8d-42f3-ac13-22b2bbce6e7f", "value": "cotizaci\u00f3n.pdf.gz.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a498f78-08a6-11ed-93bb-42010a9c0043", "comment": "Malware payload (BluStealer)", "timestamp": 1658374555, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658374555, "uuid": "bd05aa81-44bc-4a79-9aeb-8028dc088f50", "comment": "Malware payload (BluStealer)", "value": "2603a58bbc472a179a8b937b5182dd9d", "object_relation": "md5", "Tag": [ { "name": "BluStealer", "colour": "#B2C98C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658374555, "uuid": "ec2517ac-9d2a-48be-9f66-22c40bffa681", "comment": "Malware payload (BluStealer)", "value": "d2a89003afaf641041d0b9e6105b347a45da9eb13b780403c902f4511f0061ed", "object_relation": "sha256", "Tag": [ { "name": "BluStealer", "colour": "#B2C98C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658374555, "uuid": "aa49976a-0b1e-4410-b933-dfe118eea787", "comment": "Malware payload (BluStealer)", "value": "aa6030f7857211dcaf5477d9a7389fcde4dfa710", "object_relation": "sha1", "Tag": [ { "name": "BluStealer", "colour": "#B2C98C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658374555, "uuid": "71511588-ce37-4051-8733-261651687e94", "comment": "Malware payload (BluStealer)", "value": "b81d314935c05656c576b765cf20be5e27e15467209f2de1849d507d4b03e4c9a28862a4c3cfc492880f623367bf9c98", "object_relation": "sha3-384", "Tag": [ { "name": "BluStealer", "colour": "#B2C98C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658374555, "uuid": "de02acd0-6fa3-4c58-b2a8-2b6c87eb691f", "value": "T11C05DFF630D742ACD81ABD38CEB4AC63F866DCB6518C543CEF3C364A18E957A45A1316", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658374555, "uuid": "ce93d808-75f0-497a-8a89-77bb82656e89", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658374555, "uuid": "d30f8cf5-ce38-4f4f-bc6d-545eef4fb4fc", "value": "24576:OmgMYH/UB5JiChd0i5qQZHwMYA9u18G1CNH0J7RhDuudddagzUsiWh6XOfnbcaFX:OvMYYPiOJZHwMYAIiG1B3hKudddagzUG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658374555, "uuid": "04aa68ff-cacb-42fa-ac50-52c61045f69c", "value": 845312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658374555, "uuid": "74bc734c-8a92-4aed-8241-d29ad549791a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658374555, "uuid": "98f68b8b-54dc-4fd6-bf3f-c2bc353d17ec", "value": "SecuriteInfo.com.W32.AIDetectNet.01.18353.9992", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fa993d2-0930-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1658433781, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658433781, "uuid": "a261a10f-1174-451c-b26c-434a757243c2", "comment": "Malware payload", "value": "cd1c152f2466108ff254fb110547561a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658433781, "uuid": "82e68508-fd68-4425-af82-a71dfbfe0131", "comment": "Malware payload", "value": "d30f539756477a66c4270af4eb08b47904a6fd6d6c35fa6e32123562eaff5d16", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658433781, "uuid": "d704eece-de9c-4a67-ad1c-5a048a52c050", "comment": "Malware payload", "value": "2e9db04b15751e01491d6903c75f29273dc7ea14", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658433781, "uuid": "ab51583e-f354-4f9c-ac11-2a62471eaf79", "comment": "Malware payload", "value": "8786077d8624c7c7f4c7c6277e3630ebc168573ba5f5d7e7fe6732b16b037016b788fede7ad2ae31fa1db2a7eca9e893", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658433781, "uuid": "1f864682-2f45-44c5-9d40-ecd61298587f", "value": "T199551A64A3E51115E993A77F72E08B90C8AE3C415D6EA7CF4D460AC6CA3D2F479086F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658433781, "uuid": "dc67df23-df14-425f-881c-cb04b6b1bf36", "value": "fbb4b79a85ec5d8a98f3404901c2d073", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658433781, "uuid": "3742bc6d-5d52-4e06-b287-b543e19c123e", "value": "6144:2+w2jR+A6rnCw4mq/moDB28vyGuEwzfOzJxOXNmWru42yz21YG5Pez14gjGYiREZ:DnjT6rnAR8qyLbWg19iLoz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658433781, "uuid": "77d079cd-4eef-404c-a182-9716b6f61a02", "value": 1402368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658433781, "uuid": "dc6e7a87-8ade-4094-9fab-709c5d7c6ac4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658433781, "uuid": "a0d04883-3baf-4b6e-b6b8-992812c9b2f8", "value": "cd1c152f2466108ff254fb110547561a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6695a3bd-08df-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1658399111, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658399111, "uuid": "54db76b9-ddf9-4fcd-ae29-d7b10745bb97", "comment": "Malware payload", "value": "deaa7aed97d265a9208fa13458f5e467", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658399111, "uuid": "656c7fdc-33d7-43ff-a5d8-2aa3725c1885", "comment": "Malware payload", "value": "d3b6ba0427b71bcc0a7170aec0bc22caf11526750acdb59505b1e0d49650973a", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658399111, "uuid": "0b219423-4320-475e-a795-f109438d83ff", "comment": "Malware payload", "value": "7e0e42fa80e09c01eecf1c31cfcc789505116dab", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658399111, "uuid": "17ca5a8e-387c-4069-b09d-43f83b6d7a0e", "comment": "Malware payload", "value": "067833c7d711ae338c4a7b9a072ddebbfd1e7a5d8a2346b26ed228264902d8a00f92f3bd31033ede1d4bb287a5f69151", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658399111, "uuid": "55d86eb4-90e7-4725-a64b-739d49c4b7c1", "value": "T13D663355DC028DC4C351D673899E2FE1773A04BA0D9B2B460B7AA1393CD37BD9BAC885", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658399111, "uuid": "1817c8ec-29e2-458b-b136-714e015785a3", "value": "196608:lCx6YAsUEelDldcadvpvTSEPfxAXOAAiLZHdpV7d:lCx6/Vldc8XxR3i9Hzf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658399111, "uuid": "1fe78381-8dc2-4df6-8167-176e7249f62e", "value": 7042896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658399111, "uuid": "a5de4d8a-07f8-4fc7-ab0f-09e23ed40b1a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658399111, "uuid": "e013983f-720a-4b3e-93f0-b9ee88540a3f", "value": "encodedfermento_out.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0c13194-08df-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1658399262, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658399262, "uuid": "c5049b1d-2098-4e99-a551-102d1a7e1f29", "comment": "Malware payload (Mirai)", "value": "a0fa639d08c68ff62435507af9bca31d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658399262, "uuid": "8f92c1f5-6495-4feb-822e-511937e8231f", "comment": "Malware payload (Mirai)", "value": "d3bccfa18216294b28692482e7f7bde592684fd0e97d1fc5cf4294356c89d3cc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658399262, "uuid": "a246b729-c1d0-46e8-bf70-7eae7d663e6d", "comment": "Malware payload (Mirai)", "value": "1e140fc277b2fb8045a978cce832ac6f8f56401d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658399262, "uuid": "c5389fae-b879-4550-845e-ae32bc038a70", "comment": "Malware payload (Mirai)", "value": "9b4249c2703d7c037247d0cb6a96a730fe842660d597aea306a9955f101c1379be205a47d66fd16465e226a052b0f123", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658399262, "uuid": "8b6b5937-5bbf-4379-aa57-9dff2e3610ff", "value": "T17FF22ADAF4029D7DF90FA27D144A8E09BD6023C552830B2767B7FFA36C321956E12E45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658399262, "uuid": "927cf246-ebd5-4ec5-8dc3-6487175ca673", "value": "384:IZejDIbLQrCqQqlbQh3WXXZmu827N9qwrMOKOfM8vWAtPjky1iL5XQENOY/86K+q:IZeHpR7pmz2sCvlPjk3L5AEN1865G1J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658399262, "uuid": "53285f72-aaae-445f-b2ec-bcfc14e83399", "value": 37164, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658399262, "uuid": "6299c9f6-833d-434d-b68f-6c2bfb089f8a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658399262, "uuid": "6669ae10-16c5-4d10-9298-1874edd8c5a6", "value": "a0fa639d08c68ff62435507af9bca31d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01e08a28-0929-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1658430724, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658430724, "uuid": "acff5d52-c83c-477b-bd59-85d201a4cc8d", "comment": "Malware payload (Mirai)", "value": "4aa6cdc1dc54727de17afc7958d080cd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658430724, "uuid": "c111f74d-75c0-409c-85ac-2f7fb4376b7b", "comment": "Malware payload (Mirai)", "value": "d3e139dd5eba1834a11eb03dcf2027c76d31b20e5b836464c323e1134d2b1d34", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658430724, "uuid": "5f909a95-bd75-4ad7-b230-280b942dde7c", "comment": "Malware payload (Mirai)", "value": "f06ae243b19b647e3ae97afafe611f0be5b122db", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658430724, "uuid": "83eb3984-5a1f-4bfc-846f-c2e51fe219f9", "comment": "Malware payload (Mirai)", "value": "52651cfdc478a389950c30c7a0b6e01e4f5384a6623ea32a96b3138dae412060e44f6c914937bee4de69ec21f811513d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658430724, "uuid": "d9a7502b-0805-4b5f-8196-812669e708ca", "value": "T134E2E1AEA2E42DB5DFCD4C3E138C0939AFD7689713699BC5272100C4AA5E4A8F4DC07C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658430724, "uuid": "416a869d-9c20-4e06-bac0-db4872f003a2", "value": "384:X3fpCLrsjHIX69URc+hmnulY1qHprFKt6zhS45vDajssVwfzmLxa39RWGVCz0Nvw:nfpWcehzJFYKgULAssKfqda3LWR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658430724, "uuid": "aafd8d79-1d23-41b5-b538-0dff9c19ef54", "value": 31960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658430724, "uuid": "ba7d5734-6adf-4c8b-918e-64b2d2f579e3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658430724, "uuid": "f93e27f4-13b9-4d8d-933e-ef031edba313", "value": "4aa6cdc1dc54727de17afc7958d080cd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "067a057d-0893-11ed-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1658366308, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658366308, "uuid": "5b1a0005-9520-4151-9fc9-54a25cf1b246", "comment": "Malware payload (Formbook)", "value": "b1ef7a20aa8a8cab65e9fd6e1df89ca4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658366308, "uuid": "7c2f6ea8-1852-4a1e-b472-c69f40af338b", "comment": "Malware payload (Formbook)", "value": "d64123468b2dcb11e9205288e0a6cb144a448944457a708807b7345a8a766675", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658366308, "uuid": "1875a968-7556-4a4b-91cd-e37eaeb0c3ce", "comment": "Malware payload (Formbook)", "value": "d77fb14d43adb85e48dac955e1b77f0a95042a25", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658366308, "uuid": "8a790a57-5b7e-4560-a39d-837379148148", "comment": "Malware payload (Formbook)", "value": "ee61d38d9425b537bb870338dac66ca80fa33b779004e381f6295ea23336b0731fbf9fc46c7f023b6929fa79adb242fa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658366308, "uuid": "9b231394-69f2-430e-80d2-6e5c904d9737", "value": "T1648409327FE0E61AE2BF1373B47490001B3DB96FA590E74DFAC421BD59927805A117AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658366308, "uuid": "1ac1abac-7cff-458c-9a1f-5e37a6bf6787", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658366308, "uuid": "d5cd228c-39b8-4cfa-9374-174e83739d2a", "value": "6144:fVIt6YKLm1tNvEhR9dYGJvtqmww61Qrt64lZGzqnCDqH901p3si7iV6KW:fGgY11tNvETwmU1668GcLiY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658366308, "uuid": "50c9a431-081e-4d86-97ae-4a0044637d36", "value": 389632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658366308, "uuid": "87b2c89e-32d6-4720-8528-e010504dfe9e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658366308, "uuid": "6a88ccb4-d94f-4987-b7d7-7e554fa7af1c", "value": "HS52874.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1dc30457-090b-11ed-93bb-42010a9c0043", "comment": "Malware payload (GuLoader)", "timestamp": 1658417886, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658417886, "uuid": "73cce9f2-b91c-45f1-a1db-f39e094c13cc", "comment": "Malware payload (GuLoader)", "value": "b939adf69168e40a9d4328170663ef7d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658417886, "uuid": "fdf8d27d-5602-487c-b599-41f4c09cdae0", "comment": "Malware payload (GuLoader)", "value": "d6d829102bf6a3de1318d233cb20baad5c2e6608482923ff687a3be26d122b47", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658417886, "uuid": "0ecd6331-b9ae-4af2-85fb-a55478f33c0e", "comment": "Malware payload (GuLoader)", "value": "174214c69584ceb45df1d86a8ebb5a8541bc7a6c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658417886, "uuid": "248ef820-cced-4beb-922c-a9a3b0829312", "comment": "Malware payload (GuLoader)", "value": "1a5f39dc6c0023b654bc2ae710433f67cb6d3b58fd0cb1280650bc899fd058d22b14d6ff77217a5e65a939ca272cf28e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658417886, "uuid": "a4fc86a3-8c4e-414e-ad6a-cc33f57e6a11", "value": "T18B2501127404E193F9090A7699FBC27507653EDAAD448B8F3288BB8F35F3606652FE1D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658417886, "uuid": "8c79effa-3dbb-40df-81ae-0b679462ab51", "value": "f10e4da994053bf80c20cee985b32e29", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658417886, "uuid": "8bf063bc-17c3-49e0-b1d6-06e663a6c69b", "value": "12288:bOjpRtQ2QvSAXOjAvy/6cu93in7FKWLYk/6BKetf:bO1HQ2QvSAXOky/3d7vcBFV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658417886, "uuid": "154906dc-2f75-4dea-bd24-23e246bbcf6c", "value": 987528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658417886, "uuid": "e85c5d63-2ee7-4268-b7d8-d0ee72b74d49", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658417886, "uuid": "786ab23b-eae1-44c3-a42b-f348fc5d9691", "value": "SecuriteInfo.com.Gen.Variant.Nemesis.9233.22451.11105", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28d5cf13-092d-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1658432508, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658432508, "uuid": "1396fab6-a8e2-4b0e-b524-c8c099726bfd", "comment": "Malware payload", "value": "a1f6b015fc285ccc79a77b543d923f44", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658432508, "uuid": "0d1c9c94-1e2f-4212-87eb-d16ff653a1ea", "comment": "Malware payload", "value": "d6e7162c6a0a8f6063c52a3346fdca5c8e2822e479a5b6e644a716b92bc653d5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658432508, "uuid": "5b6b3246-dc1d-46ea-8cec-92ee67e94021", "comment": "Malware payload", "value": "0de6584f712d2e8369d61433e7ad5e2ad5bd4193", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658432508, "uuid": "1bc83db0-740a-40a7-b4b1-5a3d822d526f", "comment": "Malware payload", "value": "90b8c78b3ba6cc98efa7e8783ef666110d51d7a2bae2f9af98365ba59bcb42f3727bbf3a359a0e9adc18dd49027dcbb2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658432508, "uuid": "3e714a92-5c9c-43dd-8a1c-dcc2bd47e07e", "value": "T15B042A7266C55057C22291F2D820BB4DF9A3D43BEE49CD82B37C19FE2BD2D50E523A25", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658432508, "uuid": "16e060b7-9105-464e-ac0c-86a420cd7b5c", "value": "3072:OHvprZNrwDa9q3WbZfEn9XWR8iIGqlZmJRsGL:wbNra2HCiIVMR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658432508, "uuid": "4a34b732-6d3d-465e-99fe-6d5d6c052a23", "value": 184320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658432508, "uuid": "00095355-d2cc-45aa-838a-f37ec195eff4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658432508, "uuid": "3d1062c9-5742-4d70-8a9d-0a23ae761577", "value": "a4lomar.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea98ded6-0927-11ed-93bb-42010a9c0043", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1658430256, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658430256, "uuid": "4d4843a6-5f7e-49bf-aa07-524a8df601dc", "comment": "Malware payload (SnakeKeylogger)", "value": "bd973c95c4364532443a76df2c148e3f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658430256, "uuid": "014b961d-848f-46f7-bb62-9abbb7cc9350", "comment": "Malware payload (SnakeKeylogger)", "value": "d6f281a00acbbfd4d9b1b74b7ca6545dd6525fcbc19d4a9757da80d06ebad837", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658430256, "uuid": "11255b3a-fcc4-41a4-8e77-ae44a04d752c", "comment": "Malware payload (SnakeKeylogger)", "value": "567b6b846fde4025315e42ddd9490c8f26342af7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658430256, "uuid": "2f8522e1-8c1b-472c-aad2-2ab0458786ee", "comment": "Malware payload (SnakeKeylogger)", "value": "b9a6d8f8bdf519aac2c5ac3e6f54d711cd01e18b83cd25b0f267512c710ca8684a9c41ae3d12711eab8399754565a7f5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658430256, "uuid": "eff46979-13df-40a0-bbb8-ffb6f47db2d6", "value": "T1E8C3F51D3BFC8904E5FE8A7315B14215CBB5B852096ACD1D0AC1F9592A7C680DE2BFE3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658430256, "uuid": "10211c42-2032-4499-8253-58d303f21685", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658430256, "uuid": "6532efdf-41a0-4339-ab41-984cf884edd8", "value": "1536:ZmtcOks6s+racPiaE3HHoZHBJWr3nb/UUZYKsBcpiOWBpaF0Kcl:ZmtcXlsbcPiaE3H6Wb8a+2wBpaFbY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658430256, "uuid": "2f75fdd9-2315-464f-ab62-cd783f0bc0e4", "value": 129536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658430256, "uuid": "14d50dce-208a-409a-948e-2d65dd452946", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658430256, "uuid": "9a2ac322-e1d9-4731-995c-0afa37be129a", "value": "bd973c95c4364532443a76df2c148e3f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce5175ab-08e6-11ed-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1658402291, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658402291, "uuid": "5b10123f-14a0-4945-94d8-19fa87df649c", "comment": "Malware payload (Formbook)", "value": "cb9a6b783d5b9396e75acb0c9a4ac02c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658402291, "uuid": "709b508c-f141-4477-b381-54f529066437", "comment": "Malware payload (Formbook)", "value": "d7f432216cfcdef1a5a3fc9406c45002f3b87c32d767b14327931cb1c53ce215", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658402291, "uuid": "bc282609-4eb4-46b2-a285-10e1219f00b7", "comment": "Malware payload (Formbook)", "value": "c4c6f3eff898a80062f2c8c75917640db853a60e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658402291, "uuid": "af1f7742-c34b-4a55-90a4-8fe0cddd22ec", "comment": "Malware payload (Formbook)", "value": "c8f6e79508e4dc5c7066add542de8cc2d2c7b9ba1e3f16fb584bae5629dc4be209163cfde474e44939149e862d17bba7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658402291, "uuid": "a636f139-4c56-4a06-b0da-32d85bd6bdc4", "value": "T135D4013370F7F901C67807B381E352581AB2630E7177E65F24EE695589D23EA8A813D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658402291, "uuid": "d937783a-b083-4ac4-9337-35475698059d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658402291, "uuid": "db57bcfa-00ab-407a-a256-2af5b70562ff", "value": "12288:1oBGQgg31hex8ZapITR1EgsHvrV9gtkYYlQ4tUwPdR3A9B1cq7KCWxuOloWzJd:1vOex+nsHvrMkTlQct3scWkuioW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658402291, "uuid": "61765918-93ab-4b2f-93f2-3befbfcd53c0", "value": 628736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658402291, "uuid": "c7822212-dd8f-4feb-9e69-2f2034ee42ed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658402291, "uuid": "38049f1d-67b6-4c10-a2eb-ba51eea32af2", "value": "Invoice N0 2000770.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57d8da70-08b1-11ed-93bb-42010a9c0043", "comment": "Malware payload (GuLoader)", "timestamp": 1658379329, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658379329, "uuid": "fad2e504-8ef0-451d-b346-9693c35ff246", "comment": "Malware payload (GuLoader)", "value": "dbd06f58dc57209aa87ff4359a8270d5", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658379329, "uuid": "0fe563de-244d-4a79-b9e2-4364d5d1c5a0", "comment": "Malware payload (GuLoader)", "value": "d7f43b780de0be69d49b921f3b6a069717a85a81dca713daa848871227b6c7c3", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658379329, "uuid": "ff88829b-bc96-4e43-9d25-8c6718a2a91c", "comment": "Malware payload (GuLoader)", "value": "2e573ead0569d11f703701f3625edb58ed95a48f", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658379329, "uuid": "b0ba9f00-6c69-423b-a968-43780ca71ecc", "comment": "Malware payload (GuLoader)", "value": "a10cca3b4d6122ff75a1c8b16af35b87a9bed52251013905fb19873ff2e9571d52a2a7acb72bac37aec03b4dda59c6f3", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658379329, "uuid": "bcb71942-fb46-4319-b37b-05d4692819e0", "value": "T16CF423F0F6EBC2DDC454FF84E2E804A199BE57654E856581FFE9103B80E63609E37262", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658379329, "uuid": "c5cfab4a-1e4e-445b-aac8-e43e884604db", "value": "12288:kwjLWZvQc4lj0PRcJVHDYEQguiupF0W+Q1TySGfZBgbhBIOyUjVZK+iQ8nZthaMZ:d3WZvQxjLjYnguTpGY1TsfZaLFyKVZ1o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658379329, "uuid": "21416bf4-f40f-4089-b7ff-9adcea9967bc", "value": 764363, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658379329, "uuid": "657c1838-c9e2-48ca-b26e-bd90fdb88f32", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658379329, "uuid": "87158d92-bbfb-4458-896a-2037e47229b1", "value": "JUSTIFICANTE+DE+TRANSFERENCIA.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f1840e9-0902-11ed-93bb-42010a9c0043", "comment": "Malware payload (Loki)", "timestamp": 1658414184, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658414184, "uuid": "27de347d-328e-4144-bc35-b529573e39c4", "comment": "Malware payload (Loki)", "value": "4c5932375b631f05ecbef369e90944a1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658414184, "uuid": "168674da-1097-464e-befb-3d8e948c2061", "comment": "Malware payload (Loki)", "value": "d8fed06ffc0203d897f846c24bd5ffbe7e34c255512b34fc3bf774803f1a58c4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658414184, "uuid": "13d463a5-75b8-427a-9f13-33f145a4dd2c", "comment": "Malware payload (Loki)", "value": "bbef3eabbd1e94cc7eaafb83eb158812af3812a2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658414184, "uuid": "be7e895d-b47e-4a43-8ef4-1e3455660556", "comment": "Malware payload (Loki)", "value": "6e58b0ad5894bc6f57c522359242a04b9c89a146d9e9150f903100976be581fe93d1201c553c8676e41b9c1827b60dec", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658414184, "uuid": "09149e41-9ee3-4f3b-898c-03b26ce7772e", "value": "T1CB45BF017BEC8B1FE2EF5338E53A0A1953F5F412A776D35D7A40A6AA1C93B815D013A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658414184, "uuid": "222204c7-f572-41c4-bbcb-79abfa1beea5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658414184, "uuid": "7a8f4054-3d49-47b3-9373-b195667ef102", "value": "24576:lDy76kZTHbx4XzSgI9fF09pXaOL1IsnpEwK5qHdVR:lSimfG1IsnpEwK5qHdV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658414184, "uuid": "725dffa0-cee6-4f22-8120-c2aadf9b4edd", "value": 1215488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658414184, "uuid": "4e674267-e9fa-4851-9035-af7c6c025df9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658414184, "uuid": "667eb30f-fcf7-494a-9640-3641585328ae", "value": "Factura comercial.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4cea5bc6-0932-11ed-93bb-42010a9c0043", "comment": "Malware payload (Gafgyt)", "timestamp": 1658434716, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658434716, "uuid": "2079f5ac-5708-4e27-9470-91b0cf2cd76e", "comment": "Malware payload (Gafgyt)", "value": "6666168f6f35b05c6864027fb0b661b2", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658434716, "uuid": "c10c3d2c-b1e4-4873-bdbb-b5713166656c", "comment": "Malware payload (Gafgyt)", "value": "da031c4f4705a483f9f2539ae55ecd0729b7b586696b11612df1c9093ba08ffd", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658434716, "uuid": "64be5a58-2b63-443a-9c2f-e1b3b5bcdfdb", "comment": "Malware payload (Gafgyt)", "value": "cd4dd4e56e18948972b675957836693ab013c201", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658434716, "uuid": "41eb8a1c-9644-4f4f-918a-224a6bfe7385", "comment": "Malware payload (Gafgyt)", "value": "2e577c6798710d9a266ac06f64dc3538f3ec153bf8efaa478543bb94e329038001137a5504baffdcb501eb07542fd311", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658434716, "uuid": "cd7b5a36-1084-48c4-a859-16dff6caeaad", "value": "T145A35C27E552C67AC08752B427DBE521A823B4B90B72330B33E4BDE56F128D91D9EF41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658434716, "uuid": "5d578c4c-822f-4071-96fa-dc8368837473", "value": "3072:uX+j4IUim7a/3P9wkTYsoNDz/dwoEvn2brmXBuOw/JZvr8:aGfP9zlebrmXBuOw/JZvr8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658434716, "uuid": "1342bfe7-114d-4d1c-ae82-073244ded311", "value": 102677, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658434716, "uuid": "391b36e7-1233-417b-b3cf-064db9363bdb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658434716, "uuid": "a5316d87-fd58-40ff-b2f0-dc59c2730f31", "value": "6666168f6f35b05c6864027fb0b661b2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "162f449a-092d-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1658432476, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658432476, "uuid": "33ce9b34-3cc3-4148-8470-0d97989d89cf", "comment": "Malware payload", "value": "d3e14048efa538c2a71b190912196906", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658432476, "uuid": "c9972721-2e0a-4a2d-95e0-f3ac47935ae0", "comment": "Malware payload", "value": "db35c1b2866001a5054d699b34dd9b6f8cf6aa8e7d3050facd237fb2633aad65", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658432476, "uuid": "c4941b6f-b5ad-464e-bd70-b6d6376a06ff", "comment": "Malware payload", "value": "89276e46008aa741091bb23d9cc15acd4c87b5dd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658432476, "uuid": "716ea785-c65c-4766-bb1d-139ad41b70b7", "comment": "Malware payload", "value": "95beabe899791fc3e7792e288edd029f460ce5b25bbd196f539e10a736eb0e0eee8522e136c6104519c0b69e3189e19a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658432476, "uuid": "68a6e4db-e876-422e-8bbd-098f946e7d9d", "value": "T177C320827145DC9AD45328F2586ED57060B47ECF8169CA0D3B83BF2A94E734334A7B9E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658432476, "uuid": "4f8c96c9-9873-40e8-a7a9-cefaca1d4b76", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658432476, "uuid": "6cd9665f-6733-4560-b527-3079c74aa293", "value": "3072:md7hY7SrOAOkGt6+duWA/t/SHUebbxCbGgKk12qk/Wn/87gUHCzQgtn9MXCk9aPR:QGt+S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658432476, "uuid": "82f6d309-f6dc-48c5-ad78-bce2e7a01517", "value": 122368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658432476, "uuid": "bc51e1e7-48f7-4d75-8bed-a6c18473c619", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658432476, "uuid": "3e41b11c-e2a5-4822-9f12-0802ddfaa0d7", "value": "SecuriteInfo.com.Trojan.Siggen18.26339.20539.12719", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "017b05f2-08ef-11ed-93bb-42010a9c0043", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1658405813, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658405813, "uuid": "0a0f406e-9280-4e86-bec1-b2de2c27ce3e", "comment": "Malware payload (SnakeKeylogger)", "value": "2c05381215fae83cbab994f42224ad1f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658405813, "uuid": "4b7e45e2-551a-40e5-b4a1-a13f7fb8152a", "comment": "Malware payload (SnakeKeylogger)", "value": "dc5bccc49bb0d66f7a484994101b62f0ec97e389ceed90dafdcba519e71aebbe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658405813, "uuid": "c48845ea-ca2a-4985-9926-d31f65443d59", "comment": "Malware payload (SnakeKeylogger)", "value": "09dbf9c3e39e542b648c84ec7a6db096724fc0ef", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658405813, "uuid": "5810841a-547d-443b-9b9d-2b3f816dfa43", "comment": "Malware payload (SnakeKeylogger)", "value": "28a656d135d6db1e0eb5134f5babe811fe54778e6602c92772ec4f466cf9c8d4da7fea89bed785f46bacdadc2d6038a6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658405813, "uuid": "42a14fb8-4676-4e80-928b-8c150ba0dc49", "value": "T19505123722F4B615C938A3F204A366842BF3710D7870E65E28DAE4EA95D5BC497903F7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658405813, "uuid": "60132df3-7aa1-4424-81c4-2b4941cd5ec0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658405813, "uuid": "07f4ae04-9b2d-463b-898f-b281a3a757e8", "value": "12288:hsjXoCvMbXwcTRdr2rDJBrTlJftA34mBSyoWV2AnIAMgsx8E31h:jFbXh1dr2rDHrTlJlA3tBSyoWx+xd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658405813, "uuid": "8c0b9c7a-f2c1-460e-8dc7-f86c14a3f89a", "value": 806912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658405813, "uuid": "bd9fa7aa-c5b0-40f1-8949-1cac7f86c327", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658405813, "uuid": "81d1b184-1ca5-4dbf-accc-92a7dbfe035a", "value": "2c05381215fae83cbab994f42224ad1f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f9b3e26-092c-11ed-93bb-42010a9c0043", "comment": "Malware payload (Smoke Loader)", "timestamp": 1658432143, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658432143, "uuid": "c7eef4c0-4640-4fd2-9504-9d797170a1e7", "comment": "Malware payload (Smoke Loader)", "value": "f9ee563c25ae15645cb2b9efc72d9b5d", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658432143, "uuid": "7397e1fa-4d36-42bb-9487-37a3c59b133a", "comment": "Malware payload (Smoke Loader)", "value": "dc8550bf92c4563dfbe1f5ca71886c23f6ea1616f90f43730d6910cee916479f", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658432143, "uuid": "efd7ce47-5f4a-4b7e-b27b-45edaa9b3a75", "comment": "Malware payload (Smoke Loader)", "value": "5fee5b5da96a7716d536b8bff096dcbe96523fe3", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658432143, "uuid": "70099df1-7591-4b4e-9580-2f02b6060387", "comment": "Malware payload (Smoke Loader)", "value": "ee97f8a2a5c3e6b260c78dee32d03b1ba2865488d6051c009737616cf86361327fac0dec41c9f96ac98cc3f45bb8e8ee", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658432143, "uuid": "2c978455-318b-4e28-a854-c579eb578fa5", "value": "T10E14AE6271D0D872D5E3523098B4D7B16A3AB9226B32968F73943B2E3F302D36578357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658432143, "uuid": "1dff9bc6-9199-476c-ab93-06f77e8ca45d", "value": "b5d67d85726d53f797f7d82017938c03", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658432143, "uuid": "0b9b27f2-d4bf-4768-be7f-8fcb2149eea0", "value": "3072:qizqDPmbUHtscxSQh66C2FVh+8uYNDWIRdCxgFwH2Wt9C:3zqib0tsctw/38u0WIRwxZ2W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658432143, "uuid": "f274a6cb-57cd-4bc7-8210-d618e4b88d16", "value": 190976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658432143, "uuid": "12089e6e-80b1-4674-8a8b-692ff00f82e6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658432143, "uuid": "e5384037-321d-44ca-92cf-106c290fe1ab", "value": "f9ee563c25ae15645cb2b9efc72d9b5d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2c41e48-08be-11ed-93bb-42010a9c0043", "comment": "Malware payload (AsyncRAT)", "timestamp": 1658385065, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658385065, "uuid": "3127e30f-b3c5-4009-a945-8a8b3cd0e862", "comment": "Malware payload (AsyncRAT)", "value": "adf266d3870069d9c6ec30091d347f68", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658385065, "uuid": "172ded2a-5d7e-4ba4-bf5f-123aa7e22197", "comment": "Malware payload (AsyncRAT)", "value": "dd44612801b32da18885221e9211c565eecceeef71217b5b9858b839d6f8dc0d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658385065, "uuid": "d355908e-6054-4c05-a1cc-bcd8ea7cedb5", "comment": "Malware payload (AsyncRAT)", "value": "dc27468702ccd3139f773c72ba64d38d8a50ff07", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658385065, "uuid": "1de87dd7-770c-4608-af2b-0838637b1ecb", "comment": "Malware payload (AsyncRAT)", "value": "3e9474beb484343b0eced5e3ba51e13e5c3b6c318716eeb90260cbd3deb471b43e81036c5e9c5f4fc31f19c031b03713", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658385065, "uuid": "99f7bf2e-c5e8-4880-a7b3-62f15507aa3c", "value": "T191D4D366735DDE64E0C08CBAEE3F69F9D9C22C79F812B2532690BFE5313E16145DA012", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658385065, "uuid": "4856c174-54a9-427d-b406-9dddcac4fa85", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658385065, "uuid": "6e96f30d-2857-41de-ae15-cf7be00ac330", "value": "6144:xSyBmqk0G78MNNhrXN8d9sx40RZGI8i6e6jherVXLw1Ig:xSycICXhrMWx/4Iae6VkXUWg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658385065, "uuid": "657adf2c-4a4c-482b-9fb2-4d419bbe6dc0", "value": 611840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658385065, "uuid": "d18ffe8e-a2a0-4cff-9af9-8cd6c91dd766", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658385065, "uuid": "bc965b1d-de11-4387-ae88-0b492c2224b5", "value": "adf266d3870069d9c6ec30091d347f68", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11c5aabd-0929-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1658430751, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658430751, "uuid": "3fbbcf13-9ede-42a8-8ce2-0b492092fbc5", "comment": "Malware payload (Mirai)", "value": "084d939e822350f098d4b9a8e34619ed", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658430751, "uuid": "8a9ae1fb-1671-4cdd-8fe6-48e6509ccadf", "comment": "Malware payload (Mirai)", "value": "dd4939d4e3a2390cad90c42d3f6ef394451d33f6402c0a8f1c78856b45071af9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658430751, "uuid": "a257f6fd-4edb-4409-8dff-383466bdb0cb", "comment": "Malware payload (Mirai)", "value": "188409a4957efa3defacf45f7f95335ed27a280c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658430751, "uuid": "53d7d4c4-aac6-4f4d-a98d-cd11adb0eb5b", "comment": "Malware payload (Mirai)", "value": "c36011f8489f99d00a5cf0f6c6a9aba9551b7290920710d1714788e9a434cfd26cdcf29933b5dfccd6b762b5a0907c69", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658430751, "uuid": "17f1fe58-7226-4817-acfe-a464d9ef107e", "value": "T1FAD2E174929A38F1C1B00131FAA857D646472EB4D0FB7377B72018A5BEF71892BA01E6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658430751, "uuid": "28ac10bd-99c0-47c5-a3c7-c1fb53905fff", "value": "768:6A4uBc0T/nVvqV072G+IFYoXHZCx3Gj2as3UozK:6PuB7/nVMYn+Kf5QzK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658430751, "uuid": "e66e217b-b8f3-4383-b76f-5488df7bf0d5", "value": 29952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658430751, "uuid": "e83db5c9-7d3d-47e2-b5ef-d6e1a2a0dd7b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658430751, "uuid": "4328fb88-982b-4c52-85fb-6527cd51551c", "value": "084d939e822350f098d4b9a8e34619ed", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b08a76c-08a5-11ed-93bb-42010a9c0043", "comment": "Malware payload (Loki)", "timestamp": 1658374234, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658374234, "uuid": "658f8050-ba88-423a-8950-ffc81b90c65b", "comment": "Malware payload (Loki)", "value": "e80a5f523ccc4ab0f1bfd62d02d6b5a6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658374234, "uuid": "3b0ed6ae-1de5-4e10-a4f0-d0851a32cf87", "comment": "Malware payload (Loki)", "value": "def88fc364ed03678d528bfd6bc39f19ff1831b098aaf0705fa13063c4044a2a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658374234, "uuid": "095437d9-0980-4688-bc89-b3cb8e0b044d", "comment": "Malware payload (Loki)", "value": "4329e521519139c4282cece97f7700f4acb2bfc4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658374234, "uuid": "0fdff051-67fa-4bf1-a477-6bda0c22c195", "comment": "Malware payload (Loki)", "value": "b952c0a54933f25e58e8f4b3d18569dbdb98d7a932797760421888e033be4b77791abadc0e9b20c2a57f93dc673a96ee", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658374234, "uuid": "20b0d61f-e0eb-4efd-9a80-569948b960ea", "value": "T140F4127361F8B721C63887F214A326892BF3710D7474E62E2C9DB4EA85D5BD066017EB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658374234, "uuid": "9099f58d-5227-43db-a7e5-ee01ba23bb5e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658374234, "uuid": "9f1e3203-47d3-478d-85fe-6a265328cb21", "value": "12288:RsGwOnOP5wolOURyVotX9vqmcX3tN5Mu/FjVx8k31h:UOi+PcEtX9N5MsFjVxV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658374234, "uuid": "3e41fe8a-6efc-4eaf-926b-8efc476a71f5", "value": 757248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658374234, "uuid": "9ac1000f-81a6-400f-9c28-1e9baa36d7b6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658374234, "uuid": "a58c66f2-b749-4aeb-9749-2f31241ec391", "value": "SHIPPINGDOCUMENTSCOSCOSHIPPINGAQUARIUSFIXSCHE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7f3c715-08d2-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1658393690, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658393690, "uuid": "3431e410-d6e2-4410-93ee-e52be1bb5e80", "comment": "Malware payload (Mirai)", "value": "76443710656d1f16cbe8b8a1ee4f2b4f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658393690, "uuid": "99416bb8-1bb6-4d73-b25a-99898284cba9", "comment": "Malware payload (Mirai)", "value": "dfed6c2d064a12ab101e2ceb6e0489f47e42624e1f7e3532f091976d99d0cc7a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658393690, "uuid": "80a103e4-3275-4dda-828a-d4923e3ce480", "comment": "Malware payload (Mirai)", "value": "9fe693aee6f6096ec736e9656462990d553bcf81", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658393690, "uuid": "751b3c93-dfcf-455f-8a7a-956f4a419062", "comment": "Malware payload (Mirai)", "value": "c8b1bf9a0ae30a2f4f52be584490d27daa513a94730f4c3cc89a1f9b397888e8e2c2741abb4a91570f1b5420f80e7a80", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658393690, "uuid": "c9fff78e-af34-45cf-8f44-c87e0d94e17e", "value": "T1F19350AB7E20DB29F36C973106F76E24834A13E722E5D649D1AFC6001E7122D5C4FAB5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658393690, "uuid": "ab6b208e-6867-4347-84ee-d525d95b6a97", "value": "1536:RApMh4BHNzkuDiboEENgrUh94Q4y2AV5J7RcFb1luWuatc:AtzJDiboEENgrU8zy2AV5zcFb1luWM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658393690, "uuid": "9f380168-9c40-42d1-af5b-57ce3569c272", "value": 91908, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658393690, "uuid": "36dfac1d-933d-4ebd-8043-d62637948143", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658393690, "uuid": "d844b3f2-9dda-4793-9405-44676551f26f", "value": "76443710656d1f16cbe8b8a1ee4f2b4f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4e60fac-08b9-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1658382894, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658382894, "uuid": "06318400-bd6d-4938-bd46-1c84d62576b9", "comment": "Malware payload", "value": "8799d549936ea6dcd15eba5a773db77b", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658382894, "uuid": "9db4409b-edd8-4359-939d-7c29aff0d612", "comment": "Malware payload", "value": "e00087e505e28b7ed0b2061d82020abff7896ebb755894b5bb95fb8ae5f1698b", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658382894, "uuid": "18d8e2f5-b888-423d-9a34-dec41d0fe68d", "comment": "Malware payload", "value": "c890d0e3b7863da58cc9b73421f03e37eb50d7e4", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658382894, "uuid": "6eb91f5f-adff-4080-953a-d99e7cdd0583", "comment": "Malware payload", "value": "b6cd09ffd496f310ce0a16b46fd21d1737e02ab38d6e221de2b3e793a312e13f330366c88eed0f96466135ef5a1504d6", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658382894, "uuid": "dcff79cb-d491-4dd4-919f-6646ce9a7380", "value": "T17E34EDA0685F49B2E608DD1E25A4F6506EBAFEFB30C1147123AFE470CF55AF29EC8550", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658382894, "uuid": "6288a3a9-a6ac-4d52-a60c-55ca5194e4d3", "value": "1536:iK3bL5oYqUlBf02svZudxEto9yCUDaSufZVzFz76mAg5eeVhMDw5wfLc:iiv9xdbRVzFtr5RDAw5wfY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658382894, "uuid": "c81ba8ec-2142-4083-8188-203db05e73fb", "value": 240338, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658382894, "uuid": "7ae297e4-d543-49aa-a30d-8ec8fea1f519", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658382894, "uuid": "a5383b5d-8cfe-4a37-a225-841666f6193b", "value": "REQ_ORDER0122.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "328b4dcd-0932-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1658434671, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658434671, "uuid": "9e64346a-0278-4b26-ab5a-3e8e1e8949e5", "comment": "Malware payload", "value": "75e3225d905866c9e6a55c3d92448a8e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658434671, "uuid": "1b752a81-8a92-4119-864d-16cdd65caa64", "comment": "Malware payload", "value": "e07255e424e8e4a9e073c953921bf3ee337385d2120bf4d84b8eceb8c5d428f2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658434671, "uuid": "7de249bd-8a25-46f5-aa4d-70a868fb9eb0", "comment": "Malware payload", "value": "3bb4c5cc4629d674d40dbd5b8a62dd6559fca6eb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658434671, "uuid": "03057a5a-d34a-497a-b9eb-22f798e9c569", "comment": "Malware payload", "value": "2cc7d16171d986dfee885fe95948330d04ceb5e600293899d126cbc485e8e294bdf4747f178a15e02f6f1125d7be1f5e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658434671, "uuid": "7a221429-d9d0-4288-a980-d105e9b84aaf", "value": "T16BD3A62ABE11AFBEE268863107F75F70879521D237919382F16CD7581EB124D1C9FBA0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658434671, "uuid": "96807381-784a-43c4-93ae-0d146b96414a", "value": "3072:Pl+x1IxHoW+c1IxHoW+j1JuTjr9EHYacD0fdRUOKMY7Ovh9VvbGUmkgjFxqDATF8:QOYW9QUmkgjFxqDATF8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658434671, "uuid": "d0acb6cf-a255-4563-bf89-4689ed94802a", "value": 132895, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658434671, "uuid": "994dcf14-adf9-43b7-a0c5-a067a46bddbf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658434671, "uuid": "251efde7-9b11-4b8f-b359-19071912b192", "value": "75e3225d905866c9e6a55c3d92448a8e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83faa108-08f1-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1658406891, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658406891, "uuid": "03f7326f-8fd5-4e7e-bcdc-75104aa1a243", "comment": "Malware payload (Mirai)", "value": "f1fbb8a8c466422a07c9651040be80eb", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658406891, "uuid": "4f6c7370-1411-40e9-b2b6-7679910960b7", "comment": "Malware payload (Mirai)", "value": "e0a877a8cd92a7991d9ded3ebafda620576c1a64f65718ff1dbb3f10639bffe3", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658406891, "uuid": "b31f0521-7337-4f4f-92b0-30861adfd66f", "comment": "Malware payload (Mirai)", "value": "856ae701252de8ccdf6ec95783143ec081c84446", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658406891, "uuid": "09e37ac6-bfd6-4063-907f-e1c6f12f1f3f", "comment": "Malware payload (Mirai)", "value": "63a1ec325fd103c7db274f2c8e6693b6ee1cf5dbc0ca6178e80f5952612215d0f111810600253f7ee1124cbdaae5fbec", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658406891, "uuid": "925630a9-7010-4c10-8548-a01b04929518", "value": "T1A303F1AEFDD87A53DCCF543E939613A14AD0A680B26D4A4CB7110EC8FB1FD19A8580B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658406891, "uuid": "d73e3184-beb5-474b-a534-b99f37c63a7e", "value": "768:25gbCwu7uFY+FiDxGm42psrT2Ytf1fF1bTlP1uLGslhfWXL:aSuiO+tm4c+T2MfhF1FBMQL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658406891, "uuid": "442ec55f-c3a7-4513-9cfa-953c3652bdbd", "value": 38752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658406891, "uuid": "987e2f62-e42e-4c37-b104-3041a4e7f6a7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658406891, "uuid": "c1ae80e5-4a56-47a7-b4ee-bde093f0c169", "value": "home.mpsl-20220721-1234", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2d8bc36-0927-11ed-93bb-42010a9c0043", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1658430270, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658430270, "uuid": "7a0887a0-04c3-41ef-964c-333cc98c1e8e", "comment": "Malware payload (SnakeKeylogger)", "value": "e029e07d02f0ac875ed0ab4d9be534f0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658430270, "uuid": "3b3daebf-829b-4895-a52d-143d138bc641", "comment": "Malware payload (SnakeKeylogger)", "value": "e1624015ead4444ca1ee356b955926caa4008b69e4729f9678e845729286bb1e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658430270, "uuid": "f96884be-93c6-4df5-b5f4-c407bfe0fea9", "comment": "Malware payload (SnakeKeylogger)", "value": "fed5f989c37bd07a8a28bb1cb09099f80dfd7614", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658430270, "uuid": "28ade556-5c3d-4377-82e9-1669b758b6d2", "comment": "Malware payload (SnakeKeylogger)", "value": "18896c5ef03f910e9c337b1dfb642c53bb0a51e8702869dbdb8d6fcdbe5b36aed947b563d5df8005265812e25f22563b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658430270, "uuid": "788a7fcb-4ef9-4332-9b33-3dae382f807e", "value": "T1A315236273BFC7F9CF055F794DB926823676E32AB00DE32D24E2A406564173116B2EE4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658430270, "uuid": "0e6342db-2bc5-4c0c-aa60-8fb22bf3a8b7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658430270, "uuid": "59dc2c82-d136-44a8-8bd7-df9bd22d463f", "value": "12288:WAm1geQNsYjI+ZUdSwrhbHkJy0Rq+JdxZonFWDgqI6gLVs/I98J81XK7JBK+d6tU:WZF0U0UBFSRvd0MDxgLVoJQke+mGQOs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658430270, "uuid": "d9dba86c-d7a3-4951-8ac6-1610205cdcb1", "value": 948224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658430270, "uuid": "ec80ef37-b494-4998-8e45-80255f08dc9a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658430270, "uuid": "a579115d-0cf3-4fa0-b672-a120bda20ec5", "value": "e029e07d02f0ac875ed0ab4d9be534f0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94afc8c6-08c0-11ed-93bb-42010a9c0043", "comment": "Malware payload (AsyncRAT)", "timestamp": 1658385873, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658385873, "uuid": "cffcc9ce-9728-4764-b629-0e51699f9979", "comment": "Malware payload (AsyncRAT)", "value": "4ecb15fe8939eacf799015f8419f407e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658385873, "uuid": "c328a07f-d694-4150-bd1c-3c6a1f0e8a40", "comment": "Malware payload (AsyncRAT)", "value": "e16bcff77a3468fa10bf4d67fb5e6c7d8d19564320895acdff5e1aaef74b5cfc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658385873, "uuid": "3f5f4aa6-c47c-4643-9222-f7a78da23d33", "comment": "Malware payload (AsyncRAT)", "value": "06231d45f5a38c4fcef3ebf3d42b363c52cf23e3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658385873, "uuid": "1c4be38c-290c-445e-b6df-8456a55caad3", "comment": "Malware payload (AsyncRAT)", "value": "68913254a7fa1c201fba25ddebe5f60d88fe33dc0e45979ccdb52843f03cd745402ea48e357e3e3fc92521d8f9f21c28", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658385873, "uuid": "3952352a-463d-4530-ad2d-e0ee0e101470", "value": "T107559F73248C86EACD0CAA39A7A481F401855DB3E6EE07B1DE41775CD571720A1F2EEB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658385873, "uuid": "726292b8-90a7-4051-a801-714be98cc93d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658385873, "uuid": "749b2229-e106-41f0-8d51-f99ac60d1619", "value": "12288:mvNXAe2V/HjYmnkUytIS+5KTXF81q2rfuEI4b9YWFyZ:02VsofyuS+5Kp8FrflI4hty", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658385873, "uuid": "ab7a089a-3824-4957-9e00-3db813e8fb90", "value": 1332224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658385873, "uuid": "7209cf85-dc21-4642-a50a-11cf5ac254cc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658385873, "uuid": "4a0dc190-ba54-4bf7-b4d0-a4e48525b9fa", "value": "4ecb15fe8939eacf799015f8419f407e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19cdb808-0900-11ed-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1658413155, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658413155, "uuid": "7d8ad65a-0a8c-4304-a249-6c188669de5a", "comment": "Malware payload (AgentTesla)", "value": "0de115466afa95ca799cfc88cef4685d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658413155, "uuid": "6608b9d9-37ae-402b-a6ff-8c9cadc28075", "comment": "Malware payload (AgentTesla)", "value": "e21ad30040e32339f83535700e53d162c2d72db798f1e9b35851f07cd3bebe85", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658413155, "uuid": "a060c8c2-375b-4197-a3fe-a2d4faf8928d", "comment": "Malware payload (AgentTesla)", "value": "6298886589a8cfe28405714bc4afef76988fee51", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658413155, "uuid": "9f24f8c8-accf-4fd0-b0ed-f9846dfdbbf0", "comment": "Malware payload (AgentTesla)", "value": "ed55f5c4ff6c708dfa70d7a0106efd5ff2d67ecfb16a43aa7a5dd47a4ce4ec3ee2a36db85dd7bd6423745b116c5cf8c3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658413155, "uuid": "bfb12c7a-7ab8-4ff8-b4dc-a237045cd13c", "value": "T1A1D4023372E7E911C57843B380E352481AB2B34AB177E59F35CE269686D13DA6B813D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658413155, "uuid": "0cb4d629-cf74-4560-909b-341d893547ac", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658413155, "uuid": "87dbb1f5-0b65-410e-8720-80ac874be328", "value": "12288:RZ1QOgg31h3x8OWFudpREV5jCXZAk1Oyxq:F3xTiVkOyE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658413155, "uuid": "21ef5d87-03bd-4c32-9434-da5ed643e2b7", "value": 655360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658413155, "uuid": "e441a712-bb22-4be3-a7b6-3098e1388a9c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658413155, "uuid": "a1b778a3-48f5-46b4-8bbe-64a3f16d7f81", "value": "Proforma InvoicePI-717-016669.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dfe58cc9-08f4-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1658408333, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658408333, "uuid": "5e9146f6-b044-4c60-8f4b-48d944e23cc1", "comment": "Malware payload (Mirai)", "value": "5f5a7befcfd40273f43a8eaced5a06d8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658408333, "uuid": "945a7e76-4567-400b-a3fd-784fb84ca4ee", "comment": "Malware payload (Mirai)", "value": "e2be3b64e7e3ccc0871f624d07c905412d1b456b95dfedd4da7ea73f4a0c5938", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658408333, "uuid": "5acc1024-859b-4cfc-ba14-ef45d269b112", "comment": "Malware payload (Mirai)", "value": "23dbecfc54c1d598c51f6eb8a5e89d8f8496df8f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658408333, "uuid": "953e7956-bb3a-4354-90e4-3bcc3144e46e", "comment": "Malware payload (Mirai)", "value": "43d484ec3088ffa28710262b7203cb2e68f71cc268e28e3f50a9ad4319ed9b2536a5a69799077a606aed9d06a882480f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658408333, "uuid": "3ac047a3-9ba8-48ce-a43e-f8f53644ccbf", "value": "T1CE439D76CC7A9E54C4198638B0605B301723F518B6933FF61E8B86626853EBCF2693F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658408333, "uuid": "0ddbe57b-60c2-42dc-b89e-4d1a914e72ba", "value": "768:Eac3CREzieIqreLeQeAe/NYsgn20YlSvdOzMfvRholzT0pdlCamwh81B:Eac3CRcixq+JBSgzkz2clkpvCa/o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658408333, "uuid": "9c598c2c-e22b-49cb-bae6-afe982b8d66d", "value": 56104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658408333, "uuid": "8c1e7e02-0fb3-4632-877a-f5882d01911d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658408333, "uuid": "06c6c532-0178-452e-8f3b-9eb5c0c699cc", "value": "5f5a7befcfd40273f43a8eaced5a06d8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dea2b463-08b6-11ed-93bb-42010a9c0043", "comment": "Malware payload (Loki)", "timestamp": 1658381703, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658381703, "uuid": "60616d6d-e32c-4ff1-808b-f7835f99b928", "comment": "Malware payload (Loki)", "value": "7d49b787e12921f5b8ef332b60cf0c3b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658381703, "uuid": "17c6ca8d-e665-4d55-b454-1364733c4cda", "comment": "Malware payload (Loki)", "value": "e358b710d57d85fdfaf26cbec319efd66c1827629ce4b270b5ad80ea367e3e20", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658381703, "uuid": "b5ef6933-4bc5-4909-a3f6-08a2a95456db", "comment": "Malware payload (Loki)", "value": "75b11bf9cc93fbeff6085f1e6edd3bb98b48d923", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658381703, "uuid": "ef524639-57c2-4690-a11c-640dc9634c39", "comment": "Malware payload (Loki)", "value": "60a6eb65e0647a78582ba09c3f2e5a7e930ac8bfbf0910066efc1ed6f0546db90f7b9aefe835a10d075a08ca9ba58da3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658381703, "uuid": "18de3833-542a-447e-9729-7a0b0669279c", "value": "T192D4F11927154AB7D73D023850B52A851FF8D483E491BE0F676D2286A8E33F9FB27217", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658381703, "uuid": "766715ec-da2c-491e-ba6e-ee83cbcd4325", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658381703, "uuid": "7b9474fa-99ee-447c-9c77-289e81733b20", "value": "12288:kxT7uM3uh5IRGJ4MjPQaEl7Xkfba/2QA7TROnggHcwePsMaH6D0aA9LN:67uM3GgqPsUfbW2QAPvg8wSw+iLN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658381703, "uuid": "9ff371f4-91c6-45f4-a652-5ad829792f1d", "value": 618496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658381703, "uuid": "89ce4b27-b5c8-4e7a-8220-c221e556e9ad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658381703, "uuid": "23aef659-0394-4710-80b0-8713e194afa2", "value": "SecuriteInfo.com.Heur.MSIL.Abuja.2.24348.9947", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0b3121e-08ff-11ed-93bb-42010a9c0043", "comment": "Malware payload (RemcosRAT)", "timestamp": 1658412979, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658412979, "uuid": "cec23ab4-88ae-47e3-b849-842aed3ba911", "comment": "Malware payload (RemcosRAT)", "value": "c6e38942d022a9c2b73081ef4344e01b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658412979, "uuid": "57e56258-d274-4ed9-b082-ef0029220460", "comment": "Malware payload (RemcosRAT)", "value": "e3ad614d9a134b20b9efe02f5029d93c65ddc13322858d87c6ca3751b857413f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658412979, "uuid": "4561cb14-ab18-4e71-8e3c-69484b6d7c4f", "comment": "Malware payload (RemcosRAT)", "value": "35ceb2eea00c9333e5f57d3e661a242a5b7b2d50", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658412979, "uuid": "faa2f9cb-ca82-474d-ba97-3de272b49d9d", "comment": "Malware payload (RemcosRAT)", "value": "da1cc38b492ee6315327b4a16a9e4b704c562e1748b4486d86f5a994f0a5d80b10625ee967c0f07205e87f8caa46f49b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658412979, "uuid": "c0ab80f1-3031-4239-9c37-64c87ddbe17a", "value": "T10D0523A423E44B7DDAAC4638C880A12013BD43877857D752BFEA55D64EA73A14A10FFB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658412979, "uuid": "54309fa5-d325-44f2-86c6-032d288206c4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658412979, "uuid": "9f2cd2d3-38ab-4436-80a1-1c589761fc7f", "value": "12288:dBatDDiHJVa5QOiGtnoTZiLODMHj3X4caMoP3YQXhOSyqYp8K1HEP/TddQcIy:CKnayqiTUdDIxMoQQxdyB8KZITxL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658412979, "uuid": "ed24a7ff-67e9-4af5-a048-488944723cae", "value": 816128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658412979, "uuid": "3ee9bcd7-4d0f-4826-9cb6-fc1aeaacec80", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658412979, "uuid": "f7e9ef7f-0003-439f-82d1-dbbe415a5df3", "value": "HAA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fedf19f6-0948-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mekotio)", "timestamp": 1658444463, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658444463, "uuid": "94e62eda-0238-4173-a098-185ada20abc8", "comment": "Malware payload (Mekotio)", "value": "99ca544f98cc08c96a4c8db07b6b42f9", "object_relation": "md5", "Tag": [ { "name": "CL", "colour": "#5EDEA7", "exportable": true, "hide_tag": false }, { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658444463, "uuid": "f0a391c6-aaec-4a5f-a2fa-cdd55c96a270", "comment": "Malware payload (Mekotio)", "value": "e4340d6e0511ee2cd47a58872a4526787b103cc3f454cd41b96799e695985b85", "object_relation": "sha256", "Tag": [ { "name": "CL", "colour": "#5EDEA7", "exportable": true, "hide_tag": false }, { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658444463, "uuid": "ce888ade-48b5-4727-81cc-e3bdd12f0528", "comment": "Malware payload (Mekotio)", "value": "8a74d783b0d33190fe20acb2cc7671011473ba77", "object_relation": "sha1", "Tag": [ { "name": "CL", "colour": "#5EDEA7", "exportable": true, "hide_tag": false }, { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658444463, "uuid": "fbbaa53a-4bbc-4413-ab6a-9e5d5043e239", "comment": "Malware payload (Mekotio)", "value": "e27bf218cc1bd6b38669da8b5ce29c943970ef518adb4d23aae17d7ee83dbd63460b9dbbc5bc94521de0c02586e8ffaa", "object_relation": "sha3-384", "Tag": [ { "name": "CL", "colour": "#5EDEA7", "exportable": true, "hide_tag": false }, { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658444463, "uuid": "f9dbd8ce-4605-42b2-8c51-1153f256167e", "value": "T1E02533F879346F6358C262813AF19E94A4B2D0441E4728BFEE6BD1D5EEC8794C12DCE0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658444463, "uuid": "43aea6fe-8685-4b52-b610-f4dfcbb07b0d", "value": "24576:AcTqxHXYxUonO3k+iVT5PHiuoezZh/7GpwIZbluFvLP7CbqP:AcmxHXYuoO0ZVTFCDeVpLP7Cq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658444463, "uuid": "9f66cbc3-a209-4fe3-90b3-b3ef1b9fb718", "value": 1013989, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658444463, "uuid": "81743cb4-5e59-4064-bd14-c15fe2b43068", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658444463, "uuid": "55cc1e98-361a-4c7f-aa51-9161438600f4", "value": "X0212225487552022.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d04d271-08c4-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1658387525, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658387525, "uuid": "4f1fa937-2b43-44e2-9fe4-d885c2c538c5", "comment": "Malware payload (Mirai)", "value": "17607a77313e2a4558e1f21a5f6129ef", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658387525, "uuid": "b44137ab-2237-4d68-945b-9d333e6d8caf", "comment": "Malware payload (Mirai)", "value": "e52a87170c065de612e25944320d954dff14ddd8b8a51e13e5a85110042664a4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658387525, "uuid": "6dd5cf49-a536-428c-9f8a-1dd9babf51bd", "comment": "Malware payload (Mirai)", "value": "03f0e445fc20a0623dbc9ecd39815fa4229e2002", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658387525, "uuid": "36889aa3-56c4-4abc-a6bf-68349cfe15a5", "comment": "Malware payload (Mirai)", "value": "9534d5121f658e2dacd42c96253618cda39c4ffe4bae0f5a4c18f9fe70a30f9765f330d18962c28ea370134ac50ba5e8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658387525, "uuid": "2ac92cee-0a04-4d72-ac5e-dd311de81439", "value": "T1A16339216A752E17C0D4B4BA62F78760B2FA670E29E4C61E7C320F4DFF60684A5536F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658387525, "uuid": "567dcd34-3998-4025-b220-a353843ce463", "value": "1536:1FKexuAZlkm14IsnfhhM/bntkGomHbaBjZiGEy:bD/7DntEmo0GEy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658387525, "uuid": "4e8d7617-8410-4b06-996a-f6fc79fc1159", "value": 66900, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658387525, "uuid": "533579b3-5790-4628-bf77-1abd160338b0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658387525, "uuid": "869d5051-8332-4cac-b77b-d74474413c54", "value": "17607a77313e2a4558e1f21a5f6129ef", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94a63d8c-08df-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1658399188, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658399188, "uuid": "39dda9e6-2dd3-4459-be6e-056321a3abc4", "comment": "Malware payload (Mirai)", "value": "a7952986088e4f52b6dc04c21e797eb1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658399188, "uuid": "5d964099-a950-40cc-8d20-33c5a8072f51", "comment": "Malware payload (Mirai)", "value": "e580ad8c2b46d705043bca5c90ffd93ffd91d4a6b53a16c55a5cf395923f7d4f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658399188, "uuid": "1a63849a-d23d-4ac2-b705-74c72c6ea15d", "comment": "Malware payload (Mirai)", "value": "0ad9f67927fa0c03e71411acab1fd16dc07cbcae", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658399188, "uuid": "09df80f2-ce46-4dfc-a2f2-fef88aea32ff", "comment": "Malware payload (Mirai)", "value": "2fe9c448b7ca0232191a0a3746ee5bb91c3cbcae6886d882fc55c442cd6a0f4ff40bbb4c332ed7c7679bf7d71a46dafc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658399188, "uuid": "55fcda34-2a58-4a1c-b8de-c5c3c539ee35", "value": "T1C6F22A61B25C0A1BC1A31930263F5BD08BBFEAD122E4F685266F5B6AC975D371042FCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658399188, "uuid": "cf6c9156-0f7b-4af9-b687-0629e377f76a", "value": "768:ADe0nHRPzLH745zajWDIRccd8lPZuhQNswT1:wdLYWqIyZuhQDT1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658399188, "uuid": "06639bd3-7ccd-4cf5-96d2-8c048c68b3c7", "value": 35788, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658399188, "uuid": "2f404efa-bd1b-4c44-a35b-c902224339a6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658399188, "uuid": "7b4d88ec-c6b3-4e27-8ea3-102ec4815bfd", "value": "a7952986088e4f52b6dc04c21e797eb1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb95e14d-0928-11ed-93bb-42010a9c0043", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1658430633, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658430633, "uuid": "5658a263-d84b-4728-b2f8-a540156ada09", "comment": "Malware payload (AveMariaRAT)", "value": "30cb7761b20db96fa942f070271d23bc", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658430633, "uuid": "de1a33cf-05e7-4fe8-a632-f18d5e401b62", "comment": "Malware payload (AveMariaRAT)", "value": "e5e9fe5fa93f90c1a511b3c82612c51eb96260e78186b60ad9b21c4df4e8bc5d", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658430633, "uuid": "c72eefa3-56db-473a-aa50-49e50bbb83c1", "comment": "Malware payload (AveMariaRAT)", "value": "b7857795ab423451d7d196f7e0e45b741b75b0eb", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658430633, "uuid": "e7f3813f-7a32-49de-a862-81239464cc0d", "comment": "Malware payload (AveMariaRAT)", "value": "0843a3a678ad3c6133a68ca67243867b414945bcc61bd15806d6976f38ff1cc6652ff6e1e23e8fd73ecd13576482e0c6", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658430633, "uuid": "080a9561-9a23-4f00-9968-1da664b4ba89", "value": "T15C24DBB4685F08B2D308DD1E24A4B245AE79FEE774C1547223AFE034CF5AAF29EC8541", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658430633, "uuid": "6a276c04-689a-49a4-9476-b1763dc7dc62", "value": "1536:isP3JFR2jE0v/DFK6BcBo2qo6dBXtDCRZVzFz76mAg5eeVhMDw5wfLc:ill2yKVzFtr5RDAw5wfY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658430633, "uuid": "5902d751-fe7d-4567-b83d-ec1b59f43705", "value": 228962, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658430633, "uuid": "b960eae6-681e-4a1a-80bc-029a755362f5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658430633, "uuid": "56f339ca-93e8-4bc4-83cf-bdff9bd934af", "value": "Scan98458.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4240040f-092c-11ed-93bb-42010a9c0043", "comment": "Malware payload (Tofsee)", "timestamp": 1658432121, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658432121, "uuid": "95892794-a2d4-408f-b62e-aa013f472e65", "comment": "Malware payload (Tofsee)", "value": "e9da6f7d09227a19403a349a2252d2ed", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658432121, "uuid": "b9e251dc-ed69-4b39-9dcd-388bf53800cf", "comment": "Malware payload (Tofsee)", "value": "e64afadba25eededfb3259f10671cf5551e53341e13702489a7c334fcf6514b0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658432121, "uuid": "177ed8e4-c70f-4f47-986f-4efde3bcced4", "comment": "Malware payload (Tofsee)", "value": "fa94b24fc9a1357c3cf3c1c0ebac3ff1e6da8e81", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658432121, "uuid": "c5477efd-b964-4d9f-8a0d-4033fa28b874", "comment": "Malware payload (Tofsee)", "value": "6a51a290c098e590efa94f833e99585c78f57b35d8dbfcd716255fdc351576f4be17f1dbd211afd08878f8c7cf398d23", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658432121, "uuid": "f137b92f-f571-4629-87d7-b18efc699d1b", "value": "T1E1548D10BA90D435F4B722F84A7A92ACBA2D7ED0576451CF12D47AEE57386E0EC3131B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658432121, "uuid": "eb9f4ccd-dc73-4782-b534-80aaccccf792", "value": "4936bd3bf59f423d7f275b9b0ddc252f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658432121, "uuid": "53d89c0a-f461-4b9b-8f01-3e0708f4e4e0", "value": "6144:zBgICU4FRV7ggJTPvoZmjHtLe6glnjeHszMMU:ywof77JTPdjNK6gljvMM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658432121, "uuid": "9cd8550a-d8c9-489e-8dc7-dbb1bf25d075", "value": 300544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658432121, "uuid": "c8b5fa29-dabd-4d35-94ad-97d02c44aae4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658432121, "uuid": "b486eabc-aece-4961-ac04-16ef6eb9815d", "value": "e9da6f7d09227a19403a349a2252d2ed.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e582df4-08b8-11ed-93bb-42010a9c0043", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1658382427, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658382427, "uuid": "7ecfed13-909f-42d1-bc4b-dde429438ef8", "comment": "Malware payload (SnakeKeylogger)", "value": "5d4681788f47ae6ac70cda98d16403ef", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658382427, "uuid": "e786acfb-167b-445e-b26d-93d92a879cda", "comment": "Malware payload (SnakeKeylogger)", "value": "e7bce95f8d0c0afe68c7073eb88a60271388885c07bd9a5abfcace139eec9e9f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658382427, "uuid": "cfbb9569-60d6-432e-af99-70ddb20a73fe", "comment": "Malware payload (SnakeKeylogger)", "value": "153be356ce389c54884eccd051a12849cae23a63", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658382427, "uuid": "1c763d96-a97c-4d4d-82f8-c9652c7d2f49", "comment": "Malware payload (SnakeKeylogger)", "value": "aba79bf22c916199e93c44fcd19588220b36284ec3a4fbeca465bf17d0b3553049b86e61482c2f3b9199e485033fbe86", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658382427, "uuid": "80b70240-8cc1-43be-a4d7-a51dd1165c43", "value": "T1BD356DD1B1648D96EC7B07F16D2AA43016E36E5D54A4C10C5E9ABBDB26F3342209FE0F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658382427, "uuid": "3595afa2-076c-48c4-9740-8850077fbc3e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658382427, "uuid": "aa9c2011-b21a-4990-befc-21fbc2e8631e", "value": "12288:YQ/NzB0WCh6Cf8lEkunqinz3sxcUpgggVMKTJ6d75VCC2wq2iV/O:J/Nl0pBQEuET6hWgKxTJ+75IC2wYO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658382427, "uuid": "d9a2e056-3ab6-4a5c-b73c-516cbf12a240", "value": 1069568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658382427, "uuid": "be5c89ff-d7db-4c56-9088-fef33d1588db", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658382427, "uuid": "3861c25b-6e52-4605-85d7-cf4c6f68ab03", "value": "PO#106888.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8dcae5c-08c1-11ed-93bb-42010a9c0043", "comment": "Malware payload (RedLineStealer)", "timestamp": 1658386337, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658386337, "uuid": "11de3b16-e520-42e3-bbf6-8d2ca0989139", "comment": "Malware payload (RedLineStealer)", "value": "d80e6703c1258c9b1fb2f46acd414da3", "object_relation": "md5", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "fake crack", "colour": "#6C1B14", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658386337, "uuid": "07b08e36-b4e2-4752-9a93-3a13c0e3e4ed", "comment": "Malware payload (RedLineStealer)", "value": "e90359e355cb39a1253ce77d59f22e663403f18299dbe37e71c866728cabb3fc", "object_relation": "sha256", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "fake crack", "colour": "#6C1B14", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658386337, "uuid": "1e35c7d3-792c-4373-b35b-efef24a5e15f", "comment": "Malware payload (RedLineStealer)", "value": "e178377631603bc894d2009be570978c93eb312e", "object_relation": "sha1", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "fake crack", "colour": "#6C1B14", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658386337, "uuid": "dc1b49fb-29b8-4207-a95f-f4efd0532a50", "comment": "Malware payload (RedLineStealer)", "value": "a26589ff4a76c6e16b7222cecc082ff7516a1a35067c8ff98c1e9c854d5e70398d9906d57bcb59b5332933ded594d924", "object_relation": "sha3-384", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "fake crack", "colour": "#6C1B14", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658386337, "uuid": "93466ccc-7cd8-425c-bba6-bc952e3ac5ab", "value": "T16D85DE24F05133A2EC4ECAB405F01EA403E96E79126B47C82239B55F9777F2DDE68936", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658386337, "uuid": "6d74ae62-8449-4b4e-9fab-d33bb40ab720", "value": "24576:g1J+N417XepeBWDqwNH9PtduZGm6WBCFOS/NwzkiamtxbE8+oU:gHn1ibD7NdPrW6cS/WbtVE8+oU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658386337, "uuid": "2df154f0-aec3-4079-bd81-a4aa3012df11", "value": 1833616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658386337, "uuid": "295c29d9-60b6-4ae3-80c1-6bf90eecbd73", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658386337, "uuid": "a0bddd56-b817-455b-8db2-56c408a891c4", "value": "CCleaner 6.01.9825.exe.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5ac19dc-08c8-11ed-93bb-42010a9c0043", "comment": "Malware payload (Gozi)", "timestamp": 1658389418, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658389418, "uuid": "d1d90d29-531a-47d7-b021-63bf76eedf77", "comment": "Malware payload (Gozi)", "value": "9f8933319edf713f3cf393f9ab4fb129", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "agenziariscossione", "colour": "#3FD18A", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658389418, "uuid": "2efe7c2f-9f4b-4c1b-a3a4-3ea793431aab", "comment": "Malware payload (Gozi)", "value": "e97b5976bfc0e4e458702328789eb210371e5a1959efb33ef04aaf55d4c6b707", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "agenziariscossione", "colour": "#3FD18A", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658389418, "uuid": "115901aa-41cc-408c-869d-820682acb8c4", "comment": "Malware payload (Gozi)", "value": "4cc4ebc0b4b5d5c7d9fbd32d2cbd9ae3cf2a89a1", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "agenziariscossione", "colour": "#3FD18A", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658389418, "uuid": "06b8cb53-1e3f-49e8-a01b-6d84a29ac612", "comment": "Malware payload (Gozi)", "value": "be9abd2892ebc9630455563d0f5597c4e2c0f1338d1aabe8a06288c3a72b9c671336560ad1369f83554d2c78f9c66ff5", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "agenziariscossione", "colour": "#3FD18A", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658389418, "uuid": "f0ff4d07-2a35-4c99-9d6e-e0ff1a0ab4ff", "value": "T10023F181C999ED9AD3274AB150A0C0E2580A8840D61CDDCE5E52F8EC56713F7578EBAF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658389418, "uuid": "0a48b528-5254-47ca-8c68-9c807a085612", "value": "768:m9xVFubplnv58TGsaEVl3R2F4LBNB1U+mRQt+fBm7sMO+81/nNdUCcPWDfpdPIEK:ezFqfnSGyVlh2CLx6C+ZmgL+8FnNmCcx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658389418, "uuid": "58a8beed-0849-44dc-9ca0-8420d83117c2", "value": 46260, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658389418, "uuid": "dd99b07a-a2ab-4474-862e-8a07fecf0571", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658389418, "uuid": "d9e00c7b-8a26-449b-9630-5f3f2e3c4ba3", "value": "RAV_AR065444649_DA_1_P_4.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0629086e-0929-11ed-93bb-42010a9c0043", "comment": "Malware payload (STRRAT)", "timestamp": 1658430732, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658430732, "uuid": "cad01d26-5f71-4c24-a945-b6024be940d5", "comment": "Malware payload (STRRAT)", "value": "bd97084af43da7da528827a2a831237e", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658430732, "uuid": "3f2eab6f-c3ab-46c0-9243-00eaec0c0146", "comment": "Malware payload (STRRAT)", "value": "e9eaf6a0593808efff19bbeae68f7a247a7f088b6b3ecc927cfb33781b410ec1", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658430732, "uuid": "5745ab2e-5de8-4f51-bd7c-c3fc0c0fb985", "comment": "Malware payload (STRRAT)", "value": "caf56a79dade0f45854252baebd38a91aa8c655d", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658430732, "uuid": "3c7a3caa-7ab1-4a6a-8852-58f19d83cb25", "comment": "Malware payload (STRRAT)", "value": "4bf11822db62bb6f580c89c00cddfe737ebd76dcf95647aed22bda05f8c0412841c23b38918b36149b61e56e016f1701", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658430732, "uuid": "f2faf541-c7be-4fe8-a3c3-e41063058a68", "value": "T15A14CE3385716EE2A84C69096F24F5DF4360C3CD949D61684A7EBB07D9B2F7A200637E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658430732, "uuid": "6a93fac0-61e3-4e63-bca5-2c9194ec9b67", "value": "3072:dLRad+STQn6WSEy62hQv/gRZSUbhn3CdZ4l1dH/lAzZkhj2vnA743ZZ3GQDQUslH:dLa+GQHHT2NREmhWZ412Zk5Hq6Lb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658430732, "uuid": "beb5ef42-e500-401b-ad0e-18e541940fe5", "value": 194484, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658430732, "uuid": "3cf94db7-f757-4285-908d-641dd3c14fe7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658430732, "uuid": "1adcbc1a-557d-471a-be32-c11f56b8376d", "value": "Tax Returns Of R38,765.50.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54c2993f-08c9-11ed-93bb-42010a9c0043", "comment": "Malware payload (GuLoader)", "timestamp": 1658389632, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658389632, "uuid": "0dc14866-1be7-44bc-9054-a046e3068fe0", "comment": "Malware payload (GuLoader)", "value": "87d38f796e9b6c4535025fd646e24355", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658389632, "uuid": "6cd977b7-7e84-4f16-8bb6-286fc2959027", "comment": "Malware payload (GuLoader)", "value": "eaee0d581ecfd7aa9aa8daa5e77d3ccf9041d93d511f8cf7c5468e8309163944", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658389632, "uuid": "4122b735-e284-4e5d-92e4-b081c713569f", "comment": "Malware payload (GuLoader)", "value": "53853dc8bb215feba02c0de210a2f8ef0d4f4618", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658389632, "uuid": "7e8aead6-84c9-449c-8250-c323e2a170fd", "comment": "Malware payload (GuLoader)", "value": "58a8775413c7ecab4a9793231b14b96c636b7696d2a818000a52e50d6d367c7b8362aeabaa52cd0810e5e1d692f1558c", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658389632, "uuid": "6ed01828-acdc-48bc-afe0-c58c4583bf05", "value": "T1EB641245764B9A2BDA27E03516AC5D058B19CF854F2BCB29D9B3F37F95303CA2332162", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658389632, "uuid": "c48bf4ff-6311-4928-b2fd-b96310bbf6a1", "value": "6144:viJhGgQ8Udp8k1k+IQcfvYiex2SyJcG3fM+YYO31scnb3WsF/B:KJQgQzXpHOvJexOCsGf7Wsb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658389632, "uuid": "d60b541c-464b-4bf4-bf2b-0225aeac694b", "value": 333080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658389632, "uuid": "7a26b63c-b9b3-4501-881e-ee4fc903332d", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658389632, "uuid": "6ff24d0e-982c-4c18-9fdf-a74f393aefcf", "value": "PO2203-0154.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71e61ad6-08ba-11ed-93bb-42010a9c0043", "comment": "Malware payload (Loki)", "timestamp": 1658383238, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658383238, "uuid": "8f4fa46e-2959-4526-8ecc-011b26d1c010", "comment": "Malware payload (Loki)", "value": "5a83596b12ce7b935816efcfa57893f5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658383238, "uuid": "1781d780-79c3-4ab1-a328-a9a3023ab476", "comment": "Malware payload (Loki)", "value": "ec2a93f1858ba7e0de894944d57fb4b2f3021e5574d1b3594bfd8ffe32f7b029", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658383238, "uuid": "4f2591dc-1e40-4902-8249-5fd6e218760e", "comment": "Malware payload (Loki)", "value": "b3ad9a768de7c22d6a404a44b5384bf312bc3c39", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658383238, "uuid": "9a611d1d-14b5-45bd-a06b-377c4fb6a956", "comment": "Malware payload (Loki)", "value": "b03b8fe3d2459790e931a542bb07ba2a25942597886c4fc65bc858d0a7ade66bd1d8f2b79ef2ede4cefbd871702194bc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658383238, "uuid": "5fdac702-db3b-4e36-a528-fb60f1afb773", "value": "T106D4AF187627DE13C27917B6C1C2100457F1860AD17EDB876ECA22DA1A437EB9ECE787", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658383238, "uuid": "adae3e9b-5ad4-4538-9996-61501765469d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658383238, "uuid": "b80b8841-70ff-4aaf-ace4-25d8632701e8", "value": "12288:wheGswl+yW31hOpRwmavEsZZ5mQkDnzsj5hfdjCss:wUbwl+pOpjsZXzkDnz09te", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658383238, "uuid": "3382c9a0-cfa2-47d7-ac14-1ca9724cc941", "value": 648704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658383238, "uuid": "f17c18e5-0972-4220-90d2-bea17141153d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658383238, "uuid": "589db8c8-7e40-4225-b636-a54a633e8d91", "value": "SHIPPINGDOCUMENTSCOSCOSHIPPINGAQUARIUSFIXSCHE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42e0b4a1-08d9-11ed-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1658396474, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658396474, "uuid": "6c7c3de3-3ef3-43bc-b1bc-9e11779f02ea", "comment": "Malware payload (AgentTesla)", "value": "7c8aed3d6ba9a7c77796bbcd7279a4dc", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658396474, "uuid": "5e206328-ee6d-49f9-b976-2039c70bfc60", "comment": "Malware payload (AgentTesla)", "value": "ecbf095e0b2cf6dfb41d5b4217c6b426ecb6e863f312c870b6118932ad4c814e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658396474, "uuid": "feb1a2d3-f9bf-492a-be4d-a1d3d6e82132", "comment": "Malware payload (AgentTesla)", "value": "a34505ee963e0237057384d96a7ce4d0449adc0f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658396474, "uuid": "afc84a4b-618f-43dd-9617-1088c9f053a1", "comment": "Malware payload (AgentTesla)", "value": "294f1b250801448eddea9e93bbed4279c08c095b97b2254d1724d042f338b670dd2fb176752026bc1a74cfbe9bd9957e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658396474, "uuid": "97bae5a2-de25-47ba-a1e9-12678d2a891a", "value": "T106F4F17262A69F00C53F03B380E2164805B3AE4A6C72E7DE358E7D96B6F17D696407D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658396474, "uuid": "63c72835-96b1-4c62-bc7e-29b5b78e6703", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658396474, "uuid": "9de2b067-4749-44f6-908a-f4ef17226618", "value": "12288:Okgg31h/x8ABIB0hSfB7rD26106VLsbbMKgCyyDEk5Q6urZ:r/xq0I5fq6vLA45ygIfyZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658396474, "uuid": "30d87299-cc24-4443-9c19-330257eae826", "value": 750080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658396474, "uuid": "7abc6f10-3017-45d2-beec-67cd8bdbe4d5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658396474, "uuid": "4454f2f9-88dd-4b77-8adc-a4487c3fd16c", "value": "pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b946021-08c8-11ed-93bb-42010a9c0043", "comment": "Malware payload (GuLoader)", "timestamp": 1658389079, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658389079, "uuid": "388f2074-b50c-41d6-a17f-ec03f67b2f6b", "comment": "Malware payload (GuLoader)", "value": "b244ac2e93dd6d244425dce28240a966", "object_relation": "md5", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658389079, "uuid": "09e566a3-9668-4b0b-bd58-50ce726e30ec", "comment": "Malware payload (GuLoader)", "value": "ed753b754e062000f190888b1234b7a87b7c0630bd8b797f1841a8a558b7ce8c", "object_relation": "sha256", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658389079, "uuid": "8b236bf3-beb2-4112-8317-f6a30a9f0cea", "comment": "Malware payload (GuLoader)", "value": "a9d53e59257c6fd2a99fce37987c05673603accf", "object_relation": "sha1", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658389079, "uuid": "812aab58-d020-4ad6-bb40-5333d9c1afd4", "comment": "Malware payload (GuLoader)", "value": "47262c7349eed134506b88b14cf1af1c00635a30f0d622ba82d773cb48d493a3a9ac19c6bbca70a2d750114b8a12d109", "object_relation": "sha3-384", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658389079, "uuid": "ab6b8591-68d3-423d-809e-6f055068d6b4", "value": "T1A6A45E913312A589CEBD04B5796D876A0B502052B3D69371A71982F9D7A2037FB33F8F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658389079, "uuid": "99555587-c569-49f9-986e-aca34bfd2a55", "value": "3072:oshz21nBsV2RT1/YsN8Ydb6DrBXTc2auSbsSuOl0K:ocz+6Vk6sN8YdOnBjgthS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658389079, "uuid": "b74d5529-986b-48b5-9bbf-f9582c3c80d7", "value": 456704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658389079, "uuid": "fdf484bb-7f55-4af9-ae46-f2f34fa1cbdb", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658389079, "uuid": "a00d25ab-9064-4cbf-aa18-82b1e3a5a2b0", "value": "SKMDM_67789877455_FILE4543.IMG", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "808617f9-08f1-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1658406885, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658406885, "uuid": "299cf7c2-13b7-4bcc-9dd9-72016bb5044d", "comment": "Malware payload (Mirai)", "value": "443942176bd38d1e898aebe4f1a5f9da", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658406885, "uuid": "1612be23-8e57-4d30-97d4-f7cf5e115aba", "comment": "Malware payload (Mirai)", "value": "ee4440882d9d498263610106c09f0ca364e2d92a6b646c59a091021a354654a9", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658406885, "uuid": "4c75c1b2-21cc-4924-89b9-e730e5e5dd59", "comment": "Malware payload (Mirai)", "value": "266947cb6b9b1621ef47dce794b1e8a00503b927", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658406885, "uuid": "8eb8b959-f0b8-4947-9fba-be5396a20362", "comment": "Malware payload (Mirai)", "value": "9f80a9276bcf11f5e68e5bd9865d07ee5bded1e5ee1ed0e0ca0fcb31b2a7341da4dede28dd3424bc7dbfa02a5468fb4e", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658406885, "uuid": "bba61b06-5420-46f5-9c36-99e5387f6bee", "value": "T1FFF2F1825EACE87713C85C3D251D9EC1AAF340B6D5CA14722710D6ACCADB32DB83D287", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658406885, "uuid": "97a4070d-da57-4e59-a5bf-173bd6ec8f36", "value": "768:+RKc7j3KBpRrrnUstv7h8WmgUK+/T34+grQ4QXj5Qs3Uoz2:8KukpRvnTpFqgXms2Xj5Fz2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658406885, "uuid": "f8f4e635-d06e-4b86-80a5-904eeb9c16b5", "value": 35764, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658406885, "uuid": "8233edd8-2bf5-41ac-853e-57d923f06114", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658406885, "uuid": "49b417cd-f52f-4815-b3a2-420d814460f8", "value": "home.arm-20220721-1234", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "517ee025-0893-11ed-93bb-42010a9c0043", "comment": "Malware payload (njrat)", "timestamp": 1658366433, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658366433, "uuid": "7f3e0a95-7509-45f3-be96-726098b13693", "comment": "Malware payload (njrat)", "value": "560d64d0aad636c62b821fb0e9887201", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658366433, "uuid": "d3751446-d5ca-4f20-b8d9-9ba19e7d150c", "comment": "Malware payload (njrat)", "value": "ee7f0f0195c2efe95d6db388a0845ff4e70ee3462bd5ba23976a08ef0eb27da4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658366433, "uuid": "accadf46-c334-44b7-a3ca-72702e2afbfd", "comment": "Malware payload (njrat)", "value": "c4f2ad37fcbd029fa6393662f898b0fabb58de8b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658366433, "uuid": "999c6cca-768f-468e-9ea6-58d9a673c611", "comment": "Malware payload (njrat)", "value": "79d06a6c56a47b5c507a9ee6318e29af8faf172159a7343d9d063ac5bcba1cb38ccf7318938086d5d8b93ffecb9b2cea", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658366433, "uuid": "4e74c558-3c8f-410f-a876-da11bda6ae75", "value": "T138032A4D7BE18568C9FD097B05B2D41307BAE04F6D23D90E8EF664AA37636C18B50AE1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658366433, "uuid": "7529d0c5-f2b6-4a6b-9f7c-e4290b9fa855", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658366433, "uuid": "166345f6-b352-4836-abed-6ef3c731dfd5", "value": "384:7wtSyyaikFhkdTnNiybYTkNvpUc4vbOhqrAF+rMRTyN/0L+EcoinblneHQM3epzz:UQyKxNxbYTkNiFOkrM+rMRa8NuV5t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658366433, "uuid": "ff9498a6-d97e-4e00-9706-27a01669f65c", "value": 37888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658366433, "uuid": "41d0d4a3-7fde-43cb-9426-2e3e72965dc0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658366433, "uuid": "f5635058-ea46-437a-b206-284fb5d834fe", "value": "EE7F0F0195C2EFE95D6DB388A0845FF4E70EE3462BD5B.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77d2f348-08ac-11ed-93bb-42010a9c0043", "comment": "Malware payload (RedLineStealer)", "timestamp": 1658377235, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658377235, "uuid": "5b3a994a-f666-4b9e-9b2a-04f6cc1cac91", "comment": "Malware payload (RedLineStealer)", "value": "8ea23125d892e9454d89f7dc6ff71989", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658377235, "uuid": "5f3c0e9b-6aa2-4395-8f6f-47a186137588", "comment": "Malware payload (RedLineStealer)", "value": "effe13105e4441f81451de5b16903bef3bc0ab8a1cf7bbbe20129c6b5cb7b67a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658377235, "uuid": "3868566d-ec8c-4f32-b1d9-ad475e1f142c", "comment": "Malware payload (RedLineStealer)", "value": "26207bed87bd6855d5195740b3074dbf04d37943", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658377235, "uuid": "d02c5e6c-1ddd-429a-a6b4-aa4e240553c4", "comment": "Malware payload (RedLineStealer)", "value": "af0614a348560a5c46e621f33b6d91aa7344065174c430768567a9fc549e353af98db8d542de518275814aaea1f07e6c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658377235, "uuid": "3ea9a0da-95cd-471e-a454-b7f5ac61741c", "value": "T14A54F10177B0E432D4B35930A8B0CBB29ABA75332270559B37A42B3D9F742D16AF8757", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658377235, "uuid": "a7d82431-468f-4005-adaa-65c8e93ee9a9", "value": "085db6b068e0ab532921326907b886ab", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658377235, "uuid": "fd7ebcf3-8d5a-48d9-b286-efb9cc54daaf", "value": "6144:H/Et6ugJheRWqRzEO745s3ILYqHGt+/8mmRVdA90YV+SS0ri:fYNwhijIsECILY4Q+zV0GHS0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658377235, "uuid": "ec1f52c2-e104-4209-8d3a-22b709f4787d", "value": 297472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658377235, "uuid": "98f7d942-5679-4563-9e80-90b670fdee70", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658377235, "uuid": "46d677f8-45a1-49ad-b4da-ca76ce908b6f", "value": "8ea23125d892e9454d89f7dc6ff71989.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20d66f49-090b-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1658417891, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658417891, "uuid": "450d28e4-eb8c-45d5-b4bb-659fccce99f8", "comment": "Malware payload", "value": "46b8eca7bc63cc4581974fe2fb10d2e4", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658417891, "uuid": "b6d87563-8f96-4a28-a1dd-5b0da63d56c4", "comment": "Malware payload", "value": "f057b0b96e7bd1b33a10c18e7e423237a87610d48d276a02857a06a4ccbb73df", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658417891, "uuid": "c14f7cbb-f72f-4ba3-b285-2c0979206b74", "comment": "Malware payload", "value": "9d40db3064b5a532279bfd32746e3bcdfa89d9fd", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658417891, "uuid": "4bef789c-dab4-4a9b-81a6-21b621570012", "comment": "Malware payload", "value": "e4facbaca6d99a1395fdfce07d6e51ee1b219eed38339a6d8e9b3a94c6e5df769dc2159a2c565970083f77c2cea5d7d5", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658417891, "uuid": "69733292-36f4-492d-ad75-a8ecacaccfdf", "value": "T135D5332A2ED34F5F8B1CD87AD12B6A6C01633F8D5B64987B63D93146267B731834322C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658417891, "uuid": "890c50ab-8956-4ced-855a-ac6b5b1112a7", "value": "24576:3W0tmmUd389eyH8hkLT87e3a2apggO6CIphalaq8E57SiVc8A3QA48kBlPMF7CP2:mM2tGFapZhFvEpSwcxdkvP2eWcPuNt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658417891, "uuid": "c527389b-90cb-4137-ad4a-0cf407edbdba", "value": 2945024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658417891, "uuid": "86e9808a-2ec4-4d9d-862c-ae9f4cc2a11c", "value": "application/CDFV2", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658417891, "uuid": "1f6d4645-59d1-429a-b0a5-260f816d082b", "value": "SecuriteInfo.com.Exploit.CVE-2018-0798.4.14606.29537", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e28acdf-08b9-11ed-93bb-42010a9c0043", "comment": "Malware payload (QuasarRAT)", "timestamp": 1658382856, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658382856, "uuid": "c7ed8280-f955-4869-a43a-ddaf14cfbe15", "comment": "Malware payload (QuasarRAT)", "value": "c0e584e2df0577b59d69bebc65ba58ee", "object_relation": "md5", "Tag": [ { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658382856, "uuid": "e8ac1a8a-40de-4300-9c3d-16a3777e20c3", "comment": "Malware payload (QuasarRAT)", "value": "f0deca3a062a057b45bd075aef290b9bd88180c4f72743c29907dc3b934121d8", "object_relation": "sha256", "Tag": [ { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658382856, "uuid": "a77c716f-05c9-4d5d-99df-017f05b97a87", "comment": "Malware payload (QuasarRAT)", "value": "c12bf78c24fbc7acc4a74686a64e925239023027", "object_relation": "sha1", "Tag": [ { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658382856, "uuid": "c702e15d-b8fc-4060-9de5-a6418d9779ff", "comment": "Malware payload (QuasarRAT)", "value": "a234f9e5038e6c3c26b34817cbac49212bd51beed82adab0a37d249552efc16521de827d8a4a282ae0575f6d9213afed", "object_relation": "sha3-384", "Tag": [ { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658382856, "uuid": "d2e1b542-ff4b-47a5-98f0-ed5258bae28e", "value": "T123934A517284C872D5840B744DD68AFAA63EFC2B6E5B87173351732F3F717A08C12A9A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658382856, "uuid": "8e3c59a4-a6d5-4f13-99bb-b4a2056e1c7e", "value": "1536:mIxEtjPOtioVjDGUU1qfDlaGGx+cL2QnA8yxFMU7DsFLmUXFmeLmi9AbG7jvhoGB:mIxEtjPOtioVjDGUU1qfDlaGGx+cL2Qt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658382856, "uuid": "0a6cb6d5-634d-4ba8-a7c1-4286d471644d", "value": 95232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658382856, "uuid": "35bddd6a-fb44-41f7-8878-815923eba5e4", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658382856, "uuid": "eff12729-ab1b-4995-8aff-1f1f286b41fe", "value": "Orden de Compras.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5440577e-08ca-11ed-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1658390060, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658390060, "uuid": "12ddd3f8-7522-44db-a3e1-776ed8a3ce59", "comment": "Malware payload (Formbook)", "value": "5c8d9fb4b64117c5851e44a74d810278", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658390060, "uuid": "ff9d4d9e-16ff-4e80-afe5-550e6f42fac1", "comment": "Malware payload (Formbook)", "value": "f1245338f40ae2c67456a69152a562bc026393e7bd8f4d237a30c48baa03ea07", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658390060, "uuid": "595350c4-0c63-4c90-bebd-7ffd532eec3c", "comment": "Malware payload (Formbook)", "value": "460ae12eaf7a1ed14c4f653f224b0f0530e6adbc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658390060, "uuid": "41c6095c-a293-41a7-ad62-1ee3f41cf3d5", "comment": "Malware payload (Formbook)", "value": "598369e4e9198017a2532c50493a645eb0aeafcf14e233a6bc8d6666bc1d7da08f0cef932e28583f93bfec020a9868c6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658390060, "uuid": "be5c4d6a-74a0-4efe-b594-3305befec43b", "value": "T11305127721F5A369D83457F200A376442BB2610E3075F22E28DEBAE6C9E4BD957413E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658390060, "uuid": "2689e575-400d-425a-923a-9881b9612ccf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658390060, "uuid": "f19357c2-97dc-4b2d-af4f-9c5f0c7abc9c", "value": "12288:8s2NwjqXjFQP8Xn9a426ZPGmEnsWzCJjkRTEj8Ie+NVPUjajx8831h:OiqXjs89aeZVEn3c6a8KZ7xr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658390060, "uuid": "6455e146-1c00-4d94-a6d7-09d1ecfff6a9", "value": 832512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658390060, "uuid": "f25c521b-36f7-4725-829c-30f24623ae88", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658390060, "uuid": "8ef53779-7370-47af-b3c2-3ceb58fc72e1", "value": "0401-01_24pcs_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8874fd9d-08b8-11ed-93bb-42010a9c0043", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1658382417, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658382417, "uuid": "df634319-49a5-48e2-b8fe-1d14c96a191b", "comment": "Malware payload (SnakeKeylogger)", "value": "e8b1f61d569c1bafed59884f3c367609", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658382417, "uuid": "e83b11f6-7082-43b9-9dbd-85855099ded8", "comment": "Malware payload (SnakeKeylogger)", "value": "f136ef90f188d5b57888f7748138bebaa4cf51c1223ca0c2dbd720db8f5bd0dc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658382417, "uuid": "b17563bc-52e9-42b0-8b56-58fd05f1ff49", "comment": "Malware payload (SnakeKeylogger)", "value": "f5b6b98732ecd8bae5ef70fc1ef80c676d39900e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658382417, "uuid": "441a2ce7-4c23-4539-a8ef-f7dce73e9bc0", "comment": "Malware payload (SnakeKeylogger)", "value": "42939bb95290a94cc753de498d6222357fd8d0f207874b15b4e13c4a3344f12e5f9644f6736a9b0473f05e85a48325bf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658382417, "uuid": "9479a1cb-f489-4289-8df3-f84ab80171b1", "value": "T1F3E4AD14B6E6CD03C37C17B2CCC2144097B04945916AE78B6ECAE3DA2BC27E69DC9797", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658382417, "uuid": "58946064-3f77-4786-9ab5-2a13aad7853d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658382417, "uuid": "4bff509d-1272-4a72-82e8-3762df3d1a55", "value": "12288:iC/KYU1v631hduGP86jJR30C/xtUC5MFUYarTKW57Td:JCYsedV88z/4C5wUYarT57x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658382417, "uuid": "d646d0bd-105f-4384-8f38-2f2f4240cf97", "value": 685568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658382417, "uuid": "b9e71d06-f66b-4808-87a8-f4d0e18cc1d4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658382417, "uuid": "3645c452-0c8e-4cb0-8190-8abd3cb35c49", "value": "confirmations.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40d5c074-092c-11ed-93bb-42010a9c0043", "comment": "Malware payload (XFilesStealer)", "timestamp": 1658432118, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658432118, "uuid": "65c7d6bc-5fed-400f-9109-3eeb3d0fcc0c", "comment": "Malware payload (XFilesStealer)", "value": "9907569cbe56ec0eb5a27e29e65ab4d9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XFilesStealer", "colour": "#D1E15B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658432118, "uuid": "33e097eb-7665-41c0-b01a-9787194e9c52", "comment": "Malware payload (XFilesStealer)", "value": "f1cb6084ac66c0a7fc1371aebf60cf361b70e3882d5a7da33e24fae720094b3a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XFilesStealer", "colour": "#D1E15B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658432118, "uuid": "febed293-3116-444e-b060-a81dd5c8606e", "comment": "Malware payload (XFilesStealer)", "value": "0e01a401a99876fddd8a2cdc6b8de9600c8565d4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XFilesStealer", "colour": "#D1E15B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658432118, "uuid": "1196cb3e-8084-4acf-b2ae-2a6f5e9eb950", "comment": "Malware payload (XFilesStealer)", "value": "6a296550b2d640c3dc4d54bc972e2df2a8f520650a3822bb4e201005e174390cc7157d018d4e8ef28714071d8bcf76ee", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XFilesStealer", "colour": "#D1E15B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658432118, "uuid": "b10ecba3-4e46-4d6f-b18b-f3f7c7505b85", "value": "T14F9533BB415050D9F0DEB7F301BA72506B15FF02AC7C62D07AA4331E9E75A36865E3A8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658432118, "uuid": "8edc0890-cfca-42bd-b59a-63749ad9d6bf", "value": "02549ff92b49cce693542fc9afb10102", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658432118, "uuid": "3fecf2a5-ad63-4758-88ad-2b30c59f6ce5", "value": "49152:G6CjgPgQ2pMPStAiEgHh28X5Y0JYcXsxaK2:MEo/tCgBpY0PXc2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658432118, "uuid": "e638ea62-4977-4862-973d-ad8564e986b5", "value": 2046464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658432118, "uuid": "bb87727d-822e-4d51-af21-c7aa39fc2731", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658432118, "uuid": "6257a130-2776-412a-abd0-6ccde63c28b6", "value": "9907569cbe56ec0eb5a27e29e65ab4d9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9661c236-08be-11ed-93bb-42010a9c0043", "comment": "Malware payload (AsyncRAT)", "timestamp": 1658385017, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658385017, "uuid": "4e4ec632-fd5b-458f-9943-ec2b507596d1", "comment": "Malware payload (AsyncRAT)", "value": "41db97fef94e93d26dc5dc39b1357e47", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658385017, "uuid": "48f8903d-58d3-4442-adcd-baf20af96811", "comment": "Malware payload (AsyncRAT)", "value": "f234a3861371763fb293ba38d6a5cc82b0af13ce03ba676d3a229c9f30fbd85d", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658385017, "uuid": "fdab4589-7d35-4f0c-b0e1-430a85aa9f42", "comment": "Malware payload (AsyncRAT)", "value": "e7da54ac519c846417c78ebbc87470526cd80c9a", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658385017, "uuid": "db0c8c9d-5cda-40c6-aea5-6f6c9297901f", "comment": "Malware payload (AsyncRAT)", "value": "54e787eec66d1f0492ce0bf15193fc9c7cf35acb638627c522e89f9c7a32a212329b6041e053f7ecd411593785c61aed", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658385017, "uuid": "02609d07-061d-4b6d-8838-367df6029d7c", "value": "T1FD3522716F0B3B60CB4B4DB08D96642063DE26D3E4B61A7B6E0C736BC9C171C1DAB265", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658385017, "uuid": "9f69bcd8-ab2d-4ec8-81f9-e98f39b11eac", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658385017, "uuid": "b9e411de-2a1b-4a82-b3fd-7d3626cfd332", "value": "24576:39pJRAMJfYJ7isUz1PQX+2fWSEo42RDXLXm3J95rDEeR6:NlBRouYX+Wv42RDbXeJ9BR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658385017, "uuid": "01f60183-ae5f-4714-baa1-58eb5c872cbb", "value": 1095680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658385017, "uuid": "5a51e9d9-7322-4bb3-8c81-76f6f244aa09", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658385017, "uuid": "9bae1af0-44d5-4fb8-9de9-c7789e939515", "value": "PORD_220721PDF894.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "787b8d71-08b8-11ed-93bb-42010a9c0043", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1658382390, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658382390, "uuid": "4e7459c2-81b1-41d1-8d87-4c3d5a2fdb45", "comment": "Malware payload (SnakeKeylogger)", "value": "dd4822719a28fb5031786127d535a31c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658382390, "uuid": "24423eaa-0a4d-4c1b-9bdd-a36e9a487662", "comment": "Malware payload (SnakeKeylogger)", "value": "f293c00ae925b1e3160d4104f35de999a31728aa5b636dd945d2ceb1d5045c01", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658382390, "uuid": "839309e8-f499-4fa6-9fe7-55211635735e", "comment": "Malware payload (SnakeKeylogger)", "value": "46bcd63f9badc3a290e29ae53cc742dbdf6ea2e1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658382390, "uuid": "7fe1bd74-28c0-4dda-bed1-79ae3735442d", "comment": "Malware payload (SnakeKeylogger)", "value": "d5817df0bc32827e4a7bb13f3e2410aa98faea829d7881b454ac3fa8192de995f3fd8a4f986d993e376c1df69f6b6df9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658382390, "uuid": "023d2c9e-0c11-4f2c-b89b-83ac81dad64c", "value": "T116F41277A1F5E710C93893F2403382894BF2720D7475F16E28DAB9EA40D97D6AA107E7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658382390, "uuid": "5c8c6349-283b-48a3-bfa1-7421b80e2bf6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658382390, "uuid": "33502af5-b629-4a2d-a911-c950d0b05f19", "value": "12288:2gsYwIMHty0bfiBFoTWQgik8yN2gSBIc0YOtzFzcL1aF0Q+4cxqSDx8831h:2tIMNyKfiBFoTPxyLECYOtk4lExlx7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658382390, "uuid": "60f1d3fc-9593-4460-bd4f-86d870331ee9", "value": 786944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658382390, "uuid": "d8b7432d-f599-4d01-8c41-c0e01933b30c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658382390, "uuid": "06da8ca2-f791-44c4-a00c-5ff7ccbce8f2", "value": "PO#A88160011BD.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30034642-08f7-11ed-93bb-42010a9c0043", "comment": "Malware payload (RedLineStealer)", "timestamp": 1658409327, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658409327, "uuid": "1a2e0951-c18c-40fa-b35d-8209704e2b50", "comment": "Malware payload (RedLineStealer)", "value": "efd67cce415a94eba74a9aadc3d54072", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658409327, "uuid": "f4358282-dbca-4e43-8f43-6ea36a37959b", "comment": "Malware payload (RedLineStealer)", "value": "f2d19e1cb3e219277cc44c361ab20530b5295075da3f51daf39899050caf28f1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658409327, "uuid": "4cbc038d-920a-4076-87d1-dd7c19da3b29", "comment": "Malware payload (RedLineStealer)", "value": "1164ffbc45abf1594fef5247dff02090fa53db22", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658409327, "uuid": "f218959a-1692-4b1c-b20a-0c2c00e3b666", "comment": "Malware payload (RedLineStealer)", "value": "485d859cbe1389734f7bb348bdf3ac5f709fec0518ca6a327c74fe418bc7a1ddb4327d530b20d15ba225174eeb1023bf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658409327, "uuid": "cce06d49-68b2-4eef-b9fb-75182adb6537", "value": "T13454E16172A0C431C0A265F09879DBB5B939BC73A138158B77B43B7E3E312D265F8366", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658409327, "uuid": "2d1a3fac-f142-450a-8413-5b8770369707", "value": "401da744a568f91ec17ba84225e05b40", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658409327, "uuid": "7cfd3777-df95-4211-a6cc-e190600e8e81", "value": "6144:OF+mvSYE0n1pM2l2zNSwutI8O0D+LMgGLm3Ybi:svSYEYpM2YzIYXLPG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658409327, "uuid": "baf02d82-5bb6-4334-b776-70a8d8dd5424", "value": 301568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658409327, "uuid": "954a5a3d-46d9-428e-9887-242bde6cd331", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658409327, "uuid": "c624e7cb-062b-4774-8ae8-7baba5de6263", "value": "efd67cce415a94eba74a9aadc3d54072.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e2971dd-08a1-11ed-93bb-42010a9c0043", "comment": "Malware payload (Tofsee)", "timestamp": 1658372414, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658372414, "uuid": "d70b2cb3-d55e-4b35-90c7-29c4a5405ef9", "comment": "Malware payload (Tofsee)", "value": "b0e8bc965e47df21b2fa203a708f86c3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658372414, "uuid": "15eac167-80fa-476c-93dc-1543a985d60f", "comment": "Malware payload (Tofsee)", "value": "f33c9c6f077b7fb4d243925fe48b875581bb8af46e452b39bd4a2c3dd68f0ef9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658372414, "uuid": "f7fd9545-ce56-44ce-b060-2ca3d333bbe0", "comment": "Malware payload (Tofsee)", "value": "4ee6395a020864269d200d116501dc3e112874b6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658372414, "uuid": "245cc618-97f6-4c8b-8027-cd1df3a6e7e1", "comment": "Malware payload (Tofsee)", "value": "c21dc7f9e55b2f9c621196e59442b16fb430c80f7628961336f2e79af0074e428dbe7a4f7e198aec8894a75edfd3c296", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658372414, "uuid": "d0039479-b808-4f2a-b728-4935f7da168e", "value": "T1A71633B41B78E4ABD08C17BE193E07E96795E4F9E6E4510B23B04239B1B9D0B510EB37", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658372414, "uuid": "a0ef2bf1-efbc-4f64-8f0b-71badff54a8c", "value": "c05041e01f84e1ccca9c4451f3b6a383", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658372414, "uuid": "275388d0-64de-47d8-ab06-1e91fd151d3d", "value": "98304:JN7F5tonp787nmU3K4sKg0ZFLc8P6HGNgSjoj+xa4bqdu4LulEM8R:JN55Gn+mUa0gorPJySjoSTGEd9e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658372414, "uuid": "7549d902-5b03-4614-8e66-721680245318", "value": 4054508, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658372414, "uuid": "b0daef32-be70-4e5c-8050-f52be96db654", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658372414, "uuid": "8807a52d-ce10-42bb-9558-8165a4518d4a", "value": "b0e8bc965e47df21b2fa203a708f86c3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0878588b-08f0-11ed-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1658406254, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658406254, "uuid": "44760a0a-602c-4efc-8e4e-9d14c57ec738", "comment": "Malware payload (Formbook)", "value": "d2d43177d82d02df2145c232ce5a512d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658406254, "uuid": "592460de-355a-47f9-a3ca-d419cf35b070", "comment": "Malware payload (Formbook)", "value": "f3f7f4e778f4319bfe2fe39c5f2571a252b89ffbe09b5256ff05b8c666cc282f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658406254, "uuid": "ae01fb36-d71f-4b56-b607-3d713e241e5d", "comment": "Malware payload (Formbook)", "value": "1b997328dcafb5ea8dcb3e15a89ffabef5d53051", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658406254, "uuid": "844dbbd8-993b-47ff-a866-6e64821c6bb3", "comment": "Malware payload (Formbook)", "value": "ab6736ef51cad3dc73b0ce28c23c22102613da8a0375ae80f69eac332f59f823e96230b3db8f497bdaec11b191923b4c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658406254, "uuid": "619bf25b-fb44-4dfa-9812-66fbd8b4666c", "value": "T10F15123B60E8AB25CE3847F200A369885FB3620EB076F65D28DAB4D944D57D197113FB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658406254, "uuid": "5772a465-d79d-48c0-b7c3-03206ccafa27", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658406254, "uuid": "1e9c44a3-a0f8-4ce6-ae26-175a5542b9bd", "value": "12288:MzshO4BnIQnP6oVBDMkQ2ZzvklKCk8HsolV7tJLH5PJZ6HsjcVz26cxAx8k31h:vntP6MBokdklVHsolbFZPuHsjeC6DxV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658406254, "uuid": "1d9cfa6d-761f-4b3d-9517-6dd00d7c5774", "value": 880640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658406254, "uuid": "7447d689-4b9b-4fdf-9c28-63e4944118c9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658406254, "uuid": "5ef91982-6342-4417-9be7-ce094849c678", "value": "Ziraat Bankasi Swift Mesaji.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "286eed36-08ef-11ed-93bb-42010a9c0043", "comment": "Malware payload (SilentBuilder)", "timestamp": 1658405878, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658405878, "uuid": "514461af-eca6-444a-9a68-1608d918b978", "comment": "Malware payload (SilentBuilder)", "value": "93c0cd17d1ba73dbe550a0b5525b24ba", "object_relation": "md5", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658405878, "uuid": "f1957b33-b3dc-4191-a26c-d44a7c7eee3d", "comment": "Malware payload (SilentBuilder)", "value": "f45ebff001b7fa76fd16e689dba1d490ec7aedf2624c3e0b982af15700050c2f", "object_relation": "sha256", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658405878, "uuid": "8dd0448b-e2d9-4caf-8b5f-0854a1190b20", "comment": "Malware payload (SilentBuilder)", "value": "cf2b0960b76b34ebcf3649bd6b5d9fa652f263be", "object_relation": "sha1", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658405878, "uuid": "7fe52768-8e66-48ee-9795-e2f6a93b7d11", "comment": "Malware payload (SilentBuilder)", "value": "cecf56c503996ce2c269f2d91e86c0a0013b9148771a0cd13dbf78a5627a36b7c87736cd2f3916ef20f094bd9ce7dd91", "object_relation": "sha3-384", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658405878, "uuid": "a89c1316-8972-4ba6-b52a-91ebc55d7d16", "value": "T114C250A7BA86D8C9DA8513394C738658B767FC165FA743073659F3290FB0AE08D0361B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658405878, "uuid": "3b144b19-e6bf-4054-9f32-b354b9e27c7e", "value": "768:bsk3hbdlylKsgqopeJBWhZFGkE+cL2NdAJMrt/n:bsk3hbdlylKsgqopeJBWhZFGkE+cL2NF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658405878, "uuid": "38eaff75-7bc4-4e79-bb2d-a7f4747e8fc5", "value": 26624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658405878, "uuid": "cdb6e077-79fe-48d4-868c-f382ed714585", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658405878, "uuid": "39129d40-b578-46af-bb11-9a7ed040c5bc", "value": "SWIFT.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "173efbee-08f0-11ed-93bb-42010a9c0043", "comment": "Malware payload (Vjw0rm)", "timestamp": 1658406279, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658406279, "uuid": "3e53633e-24d8-40d0-b897-7626a607a7e9", "comment": "Malware payload (Vjw0rm)", "value": "d384fe293228fa05e911f7d50a3fa9c2", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658406279, "uuid": "2f3b6bd6-22f0-44a1-8e43-0944a5670cde", "comment": "Malware payload (Vjw0rm)", "value": "f4928e301e86a289c820ea24e119cbd2de4d9d4e58d2dbae655285b9e6386396", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658406279, "uuid": "689a9851-3427-4fbc-9fab-ff6fa406abc9", "comment": "Malware payload (Vjw0rm)", "value": "e3b3bb3e76fa21cccfbca16df89551e7610c90a1", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658406279, "uuid": "cb51a4c8-b116-4637-8716-73a43632b084", "comment": "Malware payload (Vjw0rm)", "value": "df4b6f2674dc06be6b0f2be49dbda3184e96de2a8f79e2c6f9d49c4a80adfe274656bc889d005fc9ffa2c9d95839c934", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658406279, "uuid": "a115dc03-15d4-46be-ac2a-189331df5a73", "value": "T1B2926DC83E15FEA44B812991FF5DDDB42BF8C1927122C48FB8A365448238C49FD2DA9D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658406279, "uuid": "f19a34fd-0b67-4da9-9244-0eee009979f7", "value": "384:e59nn7I4puFLXwg52TDYTiWj3uN/4Db+9JFD9ERY9cNxBw5tYoN2djo:S7I8upAuwDYTiO3kWUJUY88GoN2Bo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658406279, "uuid": "ac6836f2-48d4-4c7f-8128-3483b0a223b4", "value": 19939, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658406279, "uuid": "77a0d9ab-1401-44f8-8675-7db0f7dd2db6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658406279, "uuid": "8343702d-e39a-4d8d-9327-68925aae7865", "value": "ORDER-220721.doc.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff6882f5-08c8-11ed-93bb-42010a9c0043", "comment": "Malware payload (SilentBuilder)", "timestamp": 1658389488, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658389488, "uuid": "2374ab53-b4c2-47de-bdc7-18685eccac7f", "comment": "Malware payload (SilentBuilder)", "value": "d5d6d1680a97efb6d0117395312f0904", "object_relation": "md5", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658389488, "uuid": "4bc197a4-fc07-4e42-943e-501b094781e0", "comment": "Malware payload (SilentBuilder)", "value": "f584e9a86518ed5fcb7f3fac64bf58b8c8841d9ddc089ea944a1a4e8593775da", "object_relation": "sha256", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658389488, "uuid": "5286d318-47db-413a-a5d2-c1019e1cf0aa", "comment": "Malware payload (SilentBuilder)", "value": "26e49b7306a57e2c1b9ff958c80fd14fe59b3ac5", "object_relation": "sha1", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658389488, "uuid": "5b3b34d5-cfd8-4665-8836-79006eebdbd3", "comment": "Malware payload (SilentBuilder)", "value": "a0bfd33186b2c9c72d77fee8b881421f19a93b70dfb7745bf7d538a5d808fd24b8576b4111f59a29c71ce700a2624be8", "object_relation": "sha3-384", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658389488, "uuid": "169c763e-1112-4123-968f-7688059af158", "value": "T1044402AFF782989ED99A633509A34727B1C3FC6257534609A708F3782FB47E08413E56", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658389488, "uuid": "5ee06d69-e385-4353-af02-8444a0f0e8b9", "value": "6144:StwMMIOLujPxBR2L6of3CwA+qbLXjTyLTk+iwMKxbCMsBEdovbDoelRRKxh6XgS:uwMKgFvbDJlLKr6wS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658389488, "uuid": "a9f24c42-4489-45bf-b44f-b96f04fb37c4", "value": 272896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658389488, "uuid": "08ee98aa-dc8c-40a1-9735-bcde3470c725", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658389488, "uuid": "f4442ed0-13c7-4a07-bd20-556ea7d6330f", "value": "RFQ 0721.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0696ca9d-08a4-11ed-93bb-42010a9c0043", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1658373609, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658373609, "uuid": "9ec36a82-2582-41f2-b56a-ecb9740971df", "comment": "Malware payload (SnakeKeylogger)", "value": "258e9f04ee78a1b4ef3ec21693b18ea5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658373609, "uuid": "142f31b9-7171-4467-bf67-4dc129b93fce", "comment": "Malware payload (SnakeKeylogger)", "value": "f5b5997f3b718acf9ad712558e910e0d0c4777d8882207c05510f6c42cb3013d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658373609, "uuid": "d4af6143-71e3-434d-a842-8d021ba7f70f", "comment": "Malware payload (SnakeKeylogger)", "value": "5e34cfd7f4e386243874688fd90a0e100745e66d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658373609, "uuid": "6889cef5-b870-455d-a358-1e7a5125d8ca", "comment": "Malware payload (SnakeKeylogger)", "value": "4a0e4b7e452707840dfd973c90f7f0321227c9a0a7da44746cd57ee7b479a4a1cc457ffc41e6a5945b5e77c7e9230854", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658373609, "uuid": "ef247643-09e9-4f3a-96f6-533771571eb1", "value": "T101F4127370E47725C97487F210E2A6892BF2710E7475F25E288EB8EE89E5BD116107E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658373609, "uuid": "41d93aee-c3a4-4005-a324-e58d6b7c5fd9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658373609, "uuid": "3bda15dc-276b-4d1c-9af7-6336fe13f8fd", "value": "24576:bk7qHUvzA1vz/ncdyeUAaQRDoTqA2exN:A4UvuKyeFRGT7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658373609, "uuid": "2f21ceb4-b88b-415c-b17f-4dd04ff0ef12", "value": 791040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658373609, "uuid": "f3b28408-b3f9-40fc-a0c0-8ffedc8f6ac0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658373609, "uuid": "8c7ec13b-2159-4fa3-a91b-b020aefa0bb8", "value": "Scanned Docs.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e360a5eb-08f7-11ed-93bb-42010a9c0043", "comment": "Malware payload (AsyncRAT)", "timestamp": 1658409628, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658409628, "uuid": "44cd0920-e5df-4fc6-9f57-dfa3f8d9c0d6", "comment": "Malware payload (AsyncRAT)", "value": "e7bbd7cf204e902ee3f78a59b9bae692", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658409628, "uuid": "b4efd2eb-ebd0-4b8e-8ea6-3f394899b5b5", "comment": "Malware payload (AsyncRAT)", "value": "f82670b20c35f03df591e65c3bf907fd268a9feaae5d1efc16d1adcc8ec4c8bd", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658409628, "uuid": "94371d1c-b26c-4595-a9b3-3665baa56de0", "comment": "Malware payload (AsyncRAT)", "value": "334f3ec551acec595f0f6ee51219e938b2b5044f", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658409628, "uuid": "65f9ae27-526e-43c9-9d55-a1b0fb70ab8e", "comment": "Malware payload (AsyncRAT)", "value": "c1de6e90971d47f4d3d184310295ca07c0e086a95295d2e800ed26ab3bbd1a356729422030bc79eaacbc0d9ba04a878a", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658409628, "uuid": "21868df6-20db-4ced-8aeb-f70ec31d449b", "value": "T19BA4E0D2B8A88055FC360D78DD7B0C6231251E2ADD637B9A18CEB75C063B0A151DB6FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658409628, "uuid": "973ecec1-4a58-425f-933e-f1f64a1b1d93", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658409628, "uuid": "0ab17cd9-4588-44fd-b9dd-fa9b9d28df25", "value": "6144:xE+GLJTJW+iV5zFwd8uCIwbQZyeTG3Xc8DlWWI0xKa/t8g2MLRjimwK6+UcEOQXw:xPuJ0V5Cddk0TT6cdW5Ka18OphwKbG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658409628, "uuid": "31dbc9d1-f2d6-46ff-b0cf-39e941cda02d", "value": 468992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658409628, "uuid": "0f1f7407-d1ca-4ee0-a63d-2cc48ad6b995", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658409628, "uuid": "14e1a50b-7ed5-412a-aba9-aece7c7be256", "value": "ORDER-227704.pdf..exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7a1ae21-08c0-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1658386039, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658386039, "uuid": "3d2c9eeb-c484-4d5c-a18b-24802e646ece", "comment": "Malware payload", "value": "40349cd671934b83f1c9150eb44beade", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658386039, "uuid": "92b8d2cd-f6e4-4900-a41e-ca6619f1fc03", "comment": "Malware payload", "value": "f8cf70d11e4c1620c8bf0edb1ef50d564e6d4b8a293c0948957059526b3ed6d6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658386039, "uuid": "01e54cc3-47fc-40e6-bc79-811824b78e0c", "comment": "Malware payload", "value": "51e421a4269f61b3d29f3d5f973bba1e492effac", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658386039, "uuid": "38db278a-df3f-4d15-9676-d691ba13c9b1", "comment": "Malware payload", "value": "4fde8523d6ecb7bab16bb289f3a31b10055a64330832de40f2014c661bdb72e9154136adba8485aa4cd44c428b79ac55", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658386039, "uuid": "ea9ca317-dedf-4230-94bc-3113c403579e", "value": "T1B1D4481B2F01DB14C184F4F89D5363A8D5A2FC987DEBCD2161D1271C987ABC66A2E90F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658386039, "uuid": "ec905775-3bd6-4f4f-bc03-df2d76f97ca9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658386039, "uuid": "e59f9a41-e016-4823-ac12-ce2b690e30df", "value": "6144:PD4fK+HWin/uABLqiU8ywUxEJU3jK0UxmEc2akJtuY5RKf0ArIeq4xOoRJE+c7e5:0iq/uWLqielEJU3jucutu+RKfXQoR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658386039, "uuid": "a48c57db-498e-4277-94d3-a659251406e6", "value": 645120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658386039, "uuid": "052a295c-ed07-4d09-a811-cfc0577fe9ce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658386039, "uuid": "fd7ecf42-0d2b-4799-83b4-82d102e9bff1", "value": "40349cd671934b83f1c9150eb44beade", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04be13dc-08ef-11ed-93bb-42010a9c0043", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1658405818, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658405818, "uuid": "23e644e5-316f-4982-be20-ddefb565ef6f", "comment": "Malware payload (SnakeKeylogger)", "value": "e1706bb76a8fee54ba313d5dc89914e2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658405818, "uuid": "63e1c9fe-7b8e-4b64-b751-32078d479e84", "comment": "Malware payload (SnakeKeylogger)", "value": "f92f663f8f3a0eb9aa71214253b157153bc4c9b386e4189c00017ec85e9d6913", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658405818, "uuid": "0e37e126-84c4-4674-961a-dc324aa3960f", "comment": "Malware payload (SnakeKeylogger)", "value": "69428617a0aab7646c2c82bab14cd4ffbc012ff0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658405818, "uuid": "1245fcf0-a8ae-4b7e-8e6c-140d0cf5000f", "comment": "Malware payload (SnakeKeylogger)", "value": "964307ce685e23848404a47dc5f9c213d1d11fd0ad09339f28d7b3a2f4e4af2e54c96fb1b59ce189a1b4569144f2f801", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658405818, "uuid": "9ba5d4f2-2a59-48ea-8685-66354d1f2696", "value": "T1BE356DD2F190889AED6B06F16D2BA53014E37E9D64B4810C559EBB1B66F3342209FF1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658405818, "uuid": "85a57ba6-270e-4f62-b4cb-aa94e14d4e55", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658405818, "uuid": "f75016ae-921e-4076-bf20-be676fcd8d4e", "value": "12288:nsakO4qsyoZ3xTHQ9VsEk9oV8F0rflF9WAnYzyWCcaS1hnnFQx8c31h:QO4l+c79yzl7lyCcl1Nn2xj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658405818, "uuid": "08ca3e65-362c-4621-ae52-ccc80df6e77d", "value": 1077760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658405818, "uuid": "04fbb68d-25dd-48c9-a730-7b0fe510759a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658405818, "uuid": "c54744c3-f80b-4843-a71c-211ed0eb2271", "value": "\ubb38\uc758.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b101274-08e9-11ed-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1658403252, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658403252, "uuid": "764f519c-649b-494f-a9bd-f18ccccca557", "comment": "Malware payload (AgentTesla)", "value": "afae1299725e73be5966cca9be658932", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658403252, "uuid": "191d9535-2e96-44a7-8815-3cf231820809", "comment": "Malware payload (AgentTesla)", "value": "f969f30364ae0f80e911bead13ba75e7367e12ea553319dac9d3406ea10e2dd1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658403252, "uuid": "8dfbc3eb-f791-430c-b28b-b6011e35df9e", "comment": "Malware payload (AgentTesla)", "value": "fa795d4eb73c3c504ae7d41c8675a9bbbec63125", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658403252, "uuid": "4d763f30-90f9-433e-99bf-6c691e3a35dc", "comment": "Malware payload (AgentTesla)", "value": "1ff57356e84c8e229f22a9d24dc47993694153dd5aff372ebd50cbd54f484fa8240fc3f50e1e20ef1aa2bebf26fdd161", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658403252, "uuid": "5d3264c0-615f-4dae-9e5b-2d32c12ef215", "value": "T161241B7E13855D41C6EE41BD90B6915811F1E703836AB34F6EE308EE1B172CEFA2A9D1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658403252, "uuid": "bde426fc-8cb3-45c3-a1d9-dabb81121e4b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658403252, "uuid": "a54838d2-cb4c-4b58-80bf-d3ab8b994812", "value": "3072:KUkcI1UpiAd0HsuuAnP7EmTm8deuULR0s2YJa12IDSKjUDxO+d0nxKczxLaoaoCU:pkc3DunP9VlULR0s2JmQUD0+ds3xLRa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658403252, "uuid": "31b9b53d-12a1-44cc-81b2-322d5ef419f7", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658403252, "uuid": "6c026bb9-7b64-40fb-a8b0-dfd36ca665b3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658403252, "uuid": "630cae01-bed0-4543-a266-10c35594f489", "value": "afae1299725e73be5966cca9be658932", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73c7f4f0-08b9-11ed-93bb-42010a9c0043", "comment": "Malware payload (Loki)", "timestamp": 1658382812, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658382812, "uuid": "7821b0e3-0975-487e-a6e5-0cbaf5a05572", "comment": "Malware payload (Loki)", "value": "1d5533f84df98857410e8672f6122404", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658382812, "uuid": "610e9eba-eb44-4a43-bb3f-01649c9736e8", "comment": "Malware payload (Loki)", "value": "f998a60cb95f390ca201950cf41b1764646f2f8ca91f13c05fbf78282518e741", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658382812, "uuid": "b44e2c67-50ff-4fbb-940f-03630c0a515b", "comment": "Malware payload (Loki)", "value": "2a772ef56b502f66d0b636af169ef843b823f53b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658382812, "uuid": "07efddf1-019d-46d7-9884-eca0b8e1b744", "comment": "Malware payload (Loki)", "value": "187b01e9ad66c2b4ddf83be815274e34850400a5d5f453ea57e084115a387b6b0573bee8f049dfe2bc44c1f667d58768", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658382812, "uuid": "7dc3d92e-e939-4fb4-98b3-13b6da7c2c0f", "value": "T1C1F41233A1F5E711C97847F214A352892BF2721E30B1FA5E088EB8EA85E57C45A417F7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658382812, "uuid": "9409b4e3-c753-412a-bc3c-31eaac14c981", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658382812, "uuid": "c6b441d6-61b7-48ee-8e2d-1964d95d2170", "value": "12288:PispGy/DRrt2Nas9/Sd+Ec3STMqCMO4VoPYSohmBH2UkcZ3y3yx8831h:X5ZS9e+D3STMqCMjoA7wpbZ3hxr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658382812, "uuid": "801781d1-eac6-40d8-9f5e-53a986ddce94", "value": 768000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658382812, "uuid": "4cb29da8-85c3-4c68-8aa9-86ec4ac3e49e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658382812, "uuid": "0d082e7e-9ad3-414c-9b51-404cae06bd56", "value": "RFQ 3436-01902.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "244a2143-08ff-11ed-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1658412743, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658412743, "uuid": "d14b6abe-b0c8-40cf-b428-d4349da9f20b", "comment": "Malware payload (Formbook)", "value": "48b4a61d943820326c97df23cf43b444", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658412743, "uuid": "a2778392-9312-4746-ba9c-e14e7cfd0e66", "comment": "Malware payload (Formbook)", "value": "f9d4708e6d198fd35af286d73f3d2e8a32d728243fdbc4f5deb356b19ee8045d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658412743, "uuid": "3ebb06d2-d3db-4c00-a985-b87569743013", "comment": "Malware payload (Formbook)", "value": "581f2a0267edf1082804351b8eb47a94e001c966", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658412743, "uuid": "2868fcc8-e99f-4db5-89c9-39bcf1551ad1", "comment": "Malware payload (Formbook)", "value": "4809655551c7614e53e1773b0b84bcfa63d142b900d747d0a04300e606773db4da4313dda1b76a955baf9d1e27afed63", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658412743, "uuid": "093b7743-ea5a-4839-b70b-f8799030f750", "value": "T13C05123731F5EF11C93897F204A356982AB3610D3471E64E38EEB9E996E53C081A17E7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658412743, "uuid": "a6723720-2e59-4298-8e30-ce9633750142", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658412743, "uuid": "f5f8bb6a-3968-41af-b6bd-c7be59eba6ac", "value": "12288:ksGMy0UolzaCVQPopOyYzsP638qZoKLVtjkq5K8okISql+rx2bx8c31h:GMRlz7SPQez57tjk7knq4sxj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658412743, "uuid": "b8d60ac4-d705-49b0-ac3e-29dc019cb8d5", "value": 865792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658412743, "uuid": "1afb6b62-8cb3-4256-b197-c0871d721de8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658412743, "uuid": "72f590a2-9a69-47ad-b791-8ca83491bf45", "value": "SOA-78901.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f82bf4b-08b4-11ed-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1658380738, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658380738, "uuid": "806e7c84-14d1-44e6-9194-e8bcd48f74ab", "comment": "Malware payload (AgentTesla)", "value": "745eafee338fb414e3f3db374d4f9fbe", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658380738, "uuid": "1d3d80da-71d3-403a-ab17-0bf5a11f5fc4", "comment": "Malware payload (AgentTesla)", "value": "f9eb4bdf4db2cbe963cf630bc50fc1921d8e8cc4ee3f9068afdf4f8b2813efe3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658380738, "uuid": "cdf22497-c29b-4212-ba66-544bc3327792", "comment": "Malware payload (AgentTesla)", "value": "d11cad0d813d402b0fdda976952a747979a8feef", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658380738, "uuid": "0c1e5010-e292-42e1-abef-124eb039acb4", "comment": "Malware payload (AgentTesla)", "value": "aaea78b86214e2025422ec0c499536d705a25a3556eac3e943ec14724dbe77de2427078bd8354d2552b523cd3f86cd27", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658380738, "uuid": "b270dfc0-746c-4fdb-a43b-d09e8323baf4", "value": "T1CEB4D040F6C5C52DF8FBC77D0BF4647467F5FA129609E57A2EA01D8E0A22FC44A52A32", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658380738, "uuid": "3443fd8b-0ef4-4658-88ae-8130d0a5e346", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658380738, "uuid": "d75dcf73-4dd4-41b4-a409-6366b9622485", "value": "12288:rP0uST2iNox8hUy4847KGrMWsrL8yGvaOTcz2YCQo4:7kT1yxqv4lLrUL5GvaOAz25", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658380738, "uuid": "130e7876-b0d5-433b-b984-8210598b5bf6", "value": 538624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658380738, "uuid": "46ce7138-916a-4ba2-b4ab-e30edfe208fa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658380738, "uuid": "5e495a92-9dff-4280-8da3-28ef5da06503", "value": "THE NEW ORDER.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19f49e78-0929-11ed-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1658430765, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658430765, "uuid": "902905f8-01d3-49eb-8f55-6f48bfbafd4b", "comment": "Malware payload (Formbook)", "value": "33031c2a73376da974430eb1523957ef", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658430765, "uuid": "4c1c4d71-7f13-4e6f-b476-1c46262c4b8e", "comment": "Malware payload (Formbook)", "value": "f9fb589052566428a67d48a810267affa760946834ddccc4d18d2ad5b5dff3a6", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658430765, "uuid": "af4e384a-39fa-42d3-ba94-3d1bc6484928", "comment": "Malware payload (Formbook)", "value": "c9192ca00a4320b6a2e08392ade399391bc1ecbc", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658430765, "uuid": "602549f2-96e8-4e08-a5b7-2317de755480", "comment": "Malware payload (Formbook)", "value": "39be37b1f259e4538580bb6019b85de750db60576668f2039bcf5f114d6db72c959f68fcfd6f5fe5179a4ec9adb06c6a", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658430765, "uuid": "931b6dfa-3fb7-4e9b-8141-a47749ab912b", "value": "T1D305123370E5A722CA3847F3106356891AF3310D34B4E25E28DAB4EE99E9FD496507E7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658430765, "uuid": "5bdec027-7e6d-42bd-a90f-833f18456aac", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658430765, "uuid": "75040a25-71a4-420f-b5b2-57ed44750c19", "value": "24576:9d/S4lzlZqVnVVNO9mdgNp8hnvl3TLqiX6Mzaxj:b64lzlZWLO9HahvFnAMzat", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658430765, "uuid": "6a03737e-37ef-46ae-8f0b-2f592c868edc", "value": 851456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658430765, "uuid": "e25e93d2-a111-4682-b1f5-10e57c2ec533", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658430765, "uuid": "e75f281f-e71c-4b59-ab16-498f943d9b93", "value": "DHL Express_DELIVERY INFORMATION_Pdf____.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b11203c3-08ac-11ed-93bb-42010a9c0043", "comment": "Malware payload (Loki)", "timestamp": 1658377331, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658377331, "uuid": "699fa4f3-2391-4ca6-9b74-6418c00f5d94", "comment": "Malware payload (Loki)", "value": "b276cce5233ef4258af95456efb8aed8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658377331, "uuid": "50ff6866-5d55-41a1-8f38-2586b2662d34", "comment": "Malware payload (Loki)", "value": "fa4058c30f37d1cdb72e5bbcc467ff8f9b584b090bfdf723ac1f04817980096a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658377331, "uuid": "5cf04cd0-f059-4065-bc38-da8eadf797ca", "comment": "Malware payload (Loki)", "value": "cccce8eb2a301733a17cefc4783af2e25b05188a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658377331, "uuid": "b4a4bc82-db51-46ce-8a99-f2c50dbdec4d", "comment": "Malware payload (Loki)", "value": "101a269c1dcf1c91c6fd39843afd7f83b17052ccd1cf9c00bb6dc9c6c45a8310eb45b2993d2546c5855ed8b69daa7311", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658377331, "uuid": "5f15dde2-eb27-473a-b48c-cd8f59926809", "value": "T1D7F4123B60F8AB11C93457F201A3578C1AF2B10E7475E25E3C9AE4DA85E47D4A6223E7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658377331, "uuid": "6bb8e02e-1c10-44e3-beef-d47c50b80f48", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658377331, "uuid": "603d34b4-f66b-4b28-aab6-4f90ca86b942", "value": "12288:ls2hpeAdI9NAx5i9vdP/fb3HCBs7x0Y9n83pC2cZTqtjU5DdK/NC9u8PTIx8831h:hhQNA/i/fLHCu9+3A2cZTqtIDM0k8PUl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658377331, "uuid": "382b9723-33fb-413a-a416-5443dceb60db", "value": 744448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658377331, "uuid": "3ccfa657-a7a0-4373-9c39-715fd8a5a2f4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658377331, "uuid": "a74c65cc-b933-4645-bb89-e7b317da77d2", "value": "Swift MT103.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f10a55c1-08ef-11ed-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1658406215, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658406215, "uuid": "57b8b1f2-92ef-4a01-a2c4-6b73a2599bd0", "comment": "Malware payload (Formbook)", "value": "d5e211e5f47fa7ec8c5601313b884592", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658406215, "uuid": "4edab136-33d5-4546-b3be-c3a4ab8bdef1", "comment": "Malware payload (Formbook)", "value": "fa49ee27385b287c11f9ca6cb7ccf543aec70161714bc4f6aefe1baf01be0a84", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658406215, "uuid": "d4a29794-3573-4bb5-b010-157abcf6ab03", "comment": "Malware payload (Formbook)", "value": "669da02c9a334cc63695d992776d1451b506a75a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658406215, "uuid": "b5538930-0697-4825-9050-12d687b0a233", "comment": "Malware payload (Formbook)", "value": "268c7aed52b21a992e6389ef1536864d1f5b23c372e556befeecb760b711d90ba5343bd86e04dcab0fec395d3dc12a51", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658406215, "uuid": "534773e1-31c8-4eb2-8d2f-ad1ff4115988", "value": "T1CBD4D03C36B86D63C6EC45F96472129043F9C929206EF3C6ACCBB9EB66D1FB01985507", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658406215, "uuid": "e1bd3673-8713-4f91-b261-7e712e997a7c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658406215, "uuid": "ca9063b1-fbf5-4cf2-af58-f7cc58e646a3", "value": "12288:j17MI31heCQrg6ym2lj7x/mSKLQox9HOFOMr3BwvOiC:98c6ymEnx/noxtOssWpC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658406215, "uuid": "ae3b2809-6ca0-465f-87e5-46c68cc97a80", "value": 619520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658406215, "uuid": "da88d94a-cf4a-4aca-bd77-71241aabe023", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658406215, "uuid": "ba40aa2e-8f2c-47e4-8d61-5f1f88222003", "value": "e-dekont.html.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cadb5452-0927-11ed-93bb-42010a9c0043", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1658430203, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658430203, "uuid": "844498a6-4228-4439-928a-4c4cd81fe2dc", "comment": "Malware payload (SnakeKeylogger)", "value": "2667294bf62e0f1222830f215f0dc6f9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658430203, "uuid": "370a4021-c36b-49db-8433-36f4e6e75044", "comment": "Malware payload (SnakeKeylogger)", "value": "fa545bc12c20858639dc12f4c20784265671e636a95d9f32464ad92fa225a1de", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658430203, "uuid": "796e430e-2b50-4ace-a99c-51d65dbf612f", "comment": "Malware payload (SnakeKeylogger)", "value": "9dee4b74e5b27d8fbf2c832c0cb6c4c9c87edfb4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658430203, "uuid": "845113dc-d27e-4ca2-9cae-e47ba1df1a05", "comment": "Malware payload (SnakeKeylogger)", "value": "5e59e497827ef7cb1532196e0bbe204d45aac6542c28858202ef0daf1592460dc9243fa994216c9ffc3440d39eaeea5d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658430203, "uuid": "5a8a2b1a-bc1b-4e2f-a6f6-799be998f897", "value": "T17136D80052EEDA0CE0FE2A7623F5A1B4097D96055E8158BFDDC03ED45F62FA25F0E5A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658430203, "uuid": "fdaead04-0819-4a80-87c1-a2b3a390a211", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658430203, "uuid": "98e221d7-878d-4285-bbfc-3124336cbf7f", "value": "49152:onCpiz6Aq+WnrMHgBsCWD36WOIR95/gKmSL2P6:onlL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658430203, "uuid": "865aebf1-5851-48c0-8243-5509834947ee", "value": 4969472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658430203, "uuid": "ab506dad-6a87-437c-aceb-ad896bed8f38", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658430203, "uuid": "619c7c82-2ece-4457-a739-fa212c7681bf", "value": "SK3456789098765678EYE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee79487e-0919-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1658424249, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658424249, "uuid": "129802f3-56a8-4611-a5fa-475f8409eeae", "comment": "Malware payload", "value": "50652564f0ebfad3c4c6ed7e0098e530", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "iran", "colour": "#114712", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "phishing", "colour": "#6D4B87", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SmsSpy", "colour": "#EFD783", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658424249, "uuid": "a675a6a0-92dd-497e-8170-d95a3944f0bd", "comment": "Malware payload", "value": "fb546ad32603bb22cb31a4f8c3bfeae2562ead79d1445022ec4db096038802a7", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "iran", "colour": "#114712", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "phishing", "colour": "#6D4B87", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SmsSpy", "colour": "#EFD783", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658424249, "uuid": "59fd1053-9f4e-42a8-905c-4b2c008d2c77", "comment": "Malware payload", "value": "635f2d35afc4e17a766539951910eeb1b4cc9723", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "iran", "colour": "#114712", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "phishing", "colour": "#6D4B87", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SmsSpy", "colour": "#EFD783", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658424249, "uuid": "a6fd9bbc-527c-486c-b153-5c4f91723d2a", "comment": "Malware payload", "value": "5c772056baa2e182aa4f552825c37a7c111dcd24c33c8252746c115a31130b8fab6edb1bfcad9395501bb728874406ed", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "iran", "colour": "#114712", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "phishing", "colour": "#6D4B87", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SmsSpy", "colour": "#EFD783", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658424249, "uuid": "dee39520-9936-4314-ac5b-10a49a0cac59", "value": "T1C8A51217FBA6EA2BC433D0332546163661170D29CA46FB8B2C14B3BD78B799C4F966C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658424249, "uuid": "2b42da33-a2e4-4fe1-b771-3cb608c1aece", "value": "49152:cUOQMFPoWp/edmXC5zJZL3YrqV6lRVPvFSBKb+Qio:cUTMFv2dmSpJZL3YWclHQ1Fo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658424249, "uuid": "cff127d1-23bc-4c11-bf34-55f2625a844d", "value": 2133071, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658424249, "uuid": "be7bed9a-ef96-4b9b-890e-35618b9718cb", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658424249, "uuid": "891cb85e-22d8-42d6-98d5-774a2a8528e9", "value": "sana.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0f45da8-0927-11ed-93bb-42010a9c0043", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1658430266, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658430266, "uuid": "e9f99d5a-1162-46cf-a694-81bc1ece408e", "comment": "Malware payload (SnakeKeylogger)", "value": "dd5c1b7b17b2c4e4d6f390c6210237e5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658430266, "uuid": "cbe9a70b-a908-41ae-a059-ccd59f76b5e5", "comment": "Malware payload (SnakeKeylogger)", "value": "fc10c19635ddb2bb230a02f884b9b3e031dafdf2cdbf63f80f27435c68cf8861", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658430266, "uuid": "a6c58bf3-8c7b-4ec1-b1ed-17a6ae52b77d", "comment": "Malware payload (SnakeKeylogger)", "value": "071b42404e9326ec23fd6ea5de587a5d0758e9c1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658430266, "uuid": "cbf46a24-c904-48cc-868c-f4dcc5fe05a1", "comment": "Malware payload (SnakeKeylogger)", "value": "8eab3837b5d8ac6001bebdd77f6067c5bee5610937df1ff6a465e34bd855ec768a7019fa1d1d6f5cc463720ff34836b0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658430266, "uuid": "e3e6e714-99a5-4926-a5b6-d47b8c522d5d", "value": "T1BA54E1310AECDB3ADBFD8F7D5874100143B6A97B5B11E3988F41B0DA255A38189B5FA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658430266, "uuid": "3e39ec2b-971c-41a8-bafa-2447122133a5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658430266, "uuid": "df626a4e-f48a-4913-8ba8-10924f470ce9", "value": "6144:pPJXsHy60mY9lSSxmJp4s8jL4KfuGTqg8Hk47GjUyZCNvI2j3:8qSSS+sFKfuBBzij7o99", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658430266, "uuid": "6ffdb15d-cced-46b4-8d2c-ad31f82d260c", "value": 300032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658430266, "uuid": "a3343c65-5fc6-4b8a-8a95-8d23aff12414", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658430266, "uuid": "6fa6de91-66d4-4227-87fd-7a2610340702", "value": "SD09876543489.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b406b4b2-08c0-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1658385926, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658385926, "uuid": "b7b5b112-bfe4-4a83-9c56-41b2e9057c84", "comment": "Malware payload", "value": "1d356da90bbf5eeb68a7882708d7ff57", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658385926, "uuid": "b7f1d80d-d5f7-46d9-8fc8-e044b42f3a00", "comment": "Malware payload", "value": "fc1b43e1ccb7759f85d472165c0932c50c0919d73934baf496e32a6d6691076c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658385926, "uuid": "be310c28-6e1d-49f4-a7c6-82b29fb60a04", "comment": "Malware payload", "value": "b4fd6b831929264047e79f9ac1a1574a5b17f3f0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658385926, "uuid": "68122b8e-9237-46d1-b8ce-28e8f67f32cc", "comment": "Malware payload", "value": "ae81c49712f82f0f8ef21af5e57d7cbcdf1dea7035f8c4f98e9226dd9577a0a84abc3fdc23e086c49731343531220452", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658385926, "uuid": "82ea73f6-e7ad-4776-a68d-67e9853ccad4", "value": "T1077412E49318EB18D2495932CC99AF3A1335EDE3DC40190B06827F0FA67D959438BEF6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658385926, "uuid": "bb5b6d28-ae92-4a83-8033-803fd454aedd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658385926, "uuid": "ae98d0aa-7d2b-4d64-8262-09e662c7bb3c", "value": "6144:ugLivqK6RuN51K2p7AcI3ppUtFaf/zXF6cJ61MLscT3L+:qJl5k2i/S3BcqyscT7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658385926, "uuid": "5f9d9c0d-d433-4b03-b3a1-c0ef8fd05202", "value": 338432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658385926, "uuid": "072cf410-b36b-4697-b22b-ab4c2c2d88c4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658385926, "uuid": "7b9667cc-afdc-45ca-92b8-1fba7b37b829", "value": "1d356da90bbf5eeb68a7882708d7ff57", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "909c82d5-08cf-11ed-93bb-42010a9c0043", "comment": "Malware payload (SocGholish)", "timestamp": 1658392309, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658392309, "uuid": "d3c9d95a-2ab3-421a-b980-673c637a7239", "comment": "Malware payload (SocGholish)", "value": "88bd688b26df5ddfda9a2f25262245c1", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "socgholish", "colour": "#4A4C7F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658392309, "uuid": "e346cb16-2b6d-42ae-98e1-5449d98ab0d6", "comment": "Malware payload (SocGholish)", "value": "fce8074d496dcf7da784235ba66ed8e1372ff675c42e1e15cb136a41e16a4ba5", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "socgholish", "colour": "#4A4C7F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658392309, "uuid": "aea12c56-98cd-4208-9fcd-9d83e3304406", "comment": "Malware payload (SocGholish)", "value": "4dbbea4926eb78cb9ebc575e3dd3c854e06e0a50", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "socgholish", "colour": "#4A4C7F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658392309, "uuid": "2254e298-b219-4392-908d-2c7eb789cf5b", "comment": "Malware payload (SocGholish)", "value": "3b2fac7f663d68496fecf408f95562d697131db178e9fb6a48ac2c84158bb413a6557091c7859ffb7fd895fdfc3a9fdc", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "socgholish", "colour": "#4A4C7F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658392309, "uuid": "a2650a84-d1e9-4ced-9be7-6a23fe53bb07", "value": "T107F1AFC318D4A89DD9DACBBBD335C84255B706DD0A4B50373BDC6C58C8D89A076B70B2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658392309, "uuid": "8c1fb724-fca2-49e2-9163-a5c1425c5d3e", "value": "192:nHw6APWyo8WC2Jnena1FCYKN/2oFGMyPRLM1uZy0unQaTYthlmY:e7Ph2JnqPYKRliM4ZqvTYhMY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658392309, "uuid": "5cf8e851-9ce2-4e42-8fe3-486cbf237c67", "value": 7976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658392309, "uuid": "9692747f-41ae-4749-a1d8-49b74544e25e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658392309, "uuid": "aa918d75-cc9d-4676-956e-a7c00376f907", "value": "\u0395dge.\u0406nstaller.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01941a10-094d-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1658446186, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658446186, "uuid": "3ee1bf5f-2fd2-4b1b-9054-d97838039bfe", "comment": "Malware payload", "value": "56e566645423aa9a4813ccac4b136857", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Lightning", "colour": "#7AD4FF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658446186, "uuid": "25b148e2-82d7-4b22-8633-d61295bfdb7f", "comment": "Malware payload", "value": "fd285c2fb4d42dde23590118dba016bf5b846625da3abdbe48773530a07bcd1e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Lightning", "colour": "#7AD4FF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658446186, "uuid": "5a58fc58-f1e7-401e-ba48-16ba46d23f2f", "comment": "Malware payload", "value": "abc8b8e880776fd8512432dc44cdbfff6a922f69", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Lightning", "colour": "#7AD4FF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658446186, "uuid": "12cad3c8-a7dc-41d0-8b01-0029f191288e", "comment": "Malware payload", "value": "7418b81d4fe4bf4f079d94aa043e98a8d73149d9b9f6a831a88a7e95dc82f29e36c84c63d17f17d7ca196c31699fe9a3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Lightning", "colour": "#7AD4FF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658446186, "uuid": "c712f97f-68af-412d-aad3-e2dac50f08c4", "value": "T13ED3194A729228FEC192D675471F61B66C3274A85322BC7B37C0DB742906E346F5EB32", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658446186, "uuid": "e5bb919d-45f3-4761-b5c9-9ed100ef6614", "value": "3072:RzmeWhxCPbzpKRqmNZGZ8QP806SmlC4MbLBl8:RzmNhxC2LeVmLMb38", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658446186, "uuid": "c82addfc-c400-4b26-8593-42fb75c42033", "value": 133296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658446186, "uuid": "8e1b0c83-ca78-4e1b-8623-115277caa8d8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658446186, "uuid": "05b758a9-85db-42bd-a00a-7ba6a5c01ea5", "value": "fd285c2fb4d42dde23590118dba016bf5b846625da3abdbe48773530a07bcd1e.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18b6e40a-0932-11ed-93bb-42010a9c0043", "comment": "Malware payload (Gafgyt)", "timestamp": 1658434628, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658434628, "uuid": "4c513eaa-3e9a-474b-8302-ae2ec1549bd0", "comment": "Malware payload (Gafgyt)", "value": "30c19c07f2c6e0418ec8be137a2bd113", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658434628, "uuid": "a04bdaa1-35e8-452e-9e7f-390f5dbe1802", "comment": "Malware payload (Gafgyt)", "value": "fe1b2f1a3604242c28cfe48881c89a8a9e042407915daab85cbf015e73aa98a2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658434628, "uuid": "d55a5949-6187-48b8-b162-6bb3ce369b60", "comment": "Malware payload (Gafgyt)", "value": "06c94ac2ed6a45d90c8a55e91c83f378f66aa1d4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658434628, "uuid": "195478a3-2517-458e-8756-851c27a6ecb1", "comment": "Malware payload (Gafgyt)", "value": "8233616ea5bdabebe9e81d87ca024ff3bec7f7196faab73e95a8a6efa5ac0db787731064af5d46c0d3025adfcfd634c3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658434628, "uuid": "a6874254-cda1-45da-8164-af2340581d94", "value": "T14DB32B41F9048727C2D327BAE78E039D3B3657A457DB33126A347EB42BC1B992D39960", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658434628, "uuid": "4059261b-e51e-4d6c-a396-129c154c4ec1", "value": "1536:Ias8+dFE6GRGawMLD68hVR67W1W0+OjCvjWWWZTPKEG5ekpIaem48LmAYrQAmFlE:EdFGAMLdpWT2TP0pIaNmAYrQAm79XGw8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658434628, "uuid": "02315eba-df34-4dce-ae72-277e0c22846e", "value": 114550, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658434628, "uuid": "742c340e-323b-4bed-87de-8570f73193b9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658434628, "uuid": "c12c8c96-aed2-42a0-a712-0fb6a768611f", "value": "30c19c07f2c6e0418ec8be137a2bd113", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }