{ "Event": { "published": true, "date": "2023-11-20", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2023-11-20", "timestamp": 1700524982, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "46aaf265-2cc9-4306-aeb7-64078f077ce9", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94ca31d1-87a8-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700486861, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700486861, "uuid": "927f9441-7185-44f6-acb7-eb8311c546b4", "comment": "Malware payload", "value": "9af598c4f0bc134064630a616ba1d6e4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700486861, "uuid": "e2b0146c-8644-43af-8fc4-5c6c93a95855", "comment": "Malware payload", "value": "00fc37b52b2aec6ec238e9b895c8c4131392597b6c1dc75fd7bcf75f7f936a37", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700486861, "uuid": "7c544be5-a263-4dce-a09b-a9a204af3599", "comment": "Malware payload", "value": "dda98eb1584d4586bd9d8c37256010d21e589d64", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700486861, "uuid": "30f143c5-651f-497a-b4b6-a0a0c75006bd", "comment": "Malware payload", "value": "755546c3e3dca52fb66aff74b4b2728afb8dd1ebaebd1eb012f6524504f8ea6321faf637081ce8ccbc889cd01e6194da", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700486861, "uuid": "96cbe6f6-2b27-40c1-8cc0-d0f06e36000b", "value": "T1DD55F0642FCB44469661ADB3A0777D0B42F93A4D79040BFB5DCA8271323A6C42F6BF25", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700486861, "uuid": "ae609cdb-1a46-4846-bfac-8d5ea0eddc29", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700486861, "uuid": "4040cc80-8f9c-4cd0-aef1-ff49494bcea0", "value": "24576:eWpPO48WQ+NFvq/JHe214jb7Hks0+60KiEKZ9/0VtK:RWYHe4b/0+6od/aK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700486861, "uuid": "13398c0b-15ff-4533-ade4-8c7e6bb8d7cf", "value": 1336320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700486861, "uuid": "7a40285e-d940-47c2-93fa-f85b7cfa6e69", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700486861, "uuid": "f57cfd29-eb3d-4be4-b921-b62c77c4c1a6", "value": "SOA OCT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ccc702c-87c8-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700500511, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700500511, "uuid": "578fd736-9851-493b-8c1c-1150d09b05fd", "comment": "Malware payload", "value": "349872675a57dc7ec30789758a0beefc", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "WikiLoader", "colour": "#264CCC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700500511, "uuid": "530fcd0f-1361-402c-b332-c7e01e641cff", "comment": "Malware payload", "value": "04000e5047b7195b11edf23f4c3a8c32fe7661ffec461139908ae4be4e179df3", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "WikiLoader", "colour": "#264CCC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700500511, "uuid": "024eda43-267c-4cf7-b8ae-c7857044c48c", "comment": "Malware payload", "value": "5572a2b5e93e0ff890f409dbfaf3c9f9d787daf1", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "WikiLoader", "colour": "#264CCC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700500511, "uuid": "5a2486dc-90a5-4681-8a43-1e2eca6d057f", "comment": "Malware payload", "value": "81a8fdb72f60bc025a060a6a81cbb28decedb0128f1b292cacf98315392306b28366097510bd75ccda5def3781bd85a1", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "WikiLoader", "colour": "#264CCC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700500511, "uuid": "cd03f605-44d6-4f57-9a9f-2fecdc11c86c", "value": "T1DFB5024B47110BFCAA98069C19FE1E9C2A9C5E713D70D9F6787F211347225AC30FA66E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700500511, "uuid": "ccfbf954-e2f1-4d5a-813f-0fe8a62dc3bf", "value": "24576:TsVsxNve6uOfsVdvQgITK9yHgfvX62jmeVccgp4IvLJLRL2cvh4odnHnXqJ/Z0un:TsYN4DGAopNqT0uQWDODzcx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700500511, "uuid": "9a6f787e-0354-41a2-83c0-56c4069e0a9d", "value": 2430829, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700500511, "uuid": "89e6398a-aaf7-4c28-93e2-135d037fbd59", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700500511, "uuid": "dbaa3b14-a88b-43a9-bdaa-d672ca09b132", "value": "1.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b138510-8741-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700442499, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700442499, "uuid": "e7e3c0e0-15e9-4301-87f3-aee5169a4b0b", "comment": "Malware payload", "value": "485bdcda1c045fb86d8cee9018da73f4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700442499, "uuid": "ee740d58-6f03-46cd-854a-6ee13b9e7cd8", "comment": "Malware payload", "value": "04e1be0aaa77e5e69a7dd2984a91e67375e1a07fd928b74af12ab6b8aa81742b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700442499, "uuid": "c44da525-c9c8-4369-a7db-74278c38c38e", "comment": "Malware payload", "value": "469a437a2cc5187d3a4ba495153b94130ecac56d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700442499, "uuid": "8ea7a28a-3d20-425f-87a4-5fe22c93fca5", "comment": "Malware payload", "value": "c1e6301c4794312ad240277439b80748f6f1f3816d2c71ae18cba99e12e7d7000803c0c6f3946c615b65559ffbcff7b6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700442499, "uuid": "b15995a9-ef7e-45a0-bb63-1e612eeca8b1", "value": "T1C9559E71B502D037E1A101F5A67D9BA612A9BA301BAB08D7B3C05E3D95F2DC36235F27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700442499, "uuid": "43831f36-0461-4f2d-b458-cd66ff121c98", "value": "7482a1595744a3c77ac9461f3f27a729", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700442499, "uuid": "063d349a-5ddc-461d-9c1a-b07a451d3a61", "value": "24576:NmmEs2wqfcRBxJCBEmAMpCOJMbgp2kvB1Pj5R+d3ThJgrU35Zln2i6:8dw/IyPxbgp2iB1Pju3TIrK5Zln2i6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700442499, "uuid": "f9eb70a8-dd45-43c2-adc1-4ef0a3c44d47", "value": 1322326, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700442499, "uuid": "7d9c6dfb-56e0-4828-b918-c8ba9ff30b85", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700442499, "uuid": "64847ba5-b1aa-4c84-8284-e1978147d688", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24469f18-87de-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700509865, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700509865, "uuid": "a72878b2-394a-4665-8739-a49c52f7359d", "comment": "Malware payload", "value": "9df2f69cc01d8fc33f77b93300ecfc36", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700509865, "uuid": "ca06eda4-f37f-47ca-93ea-f67b8699db90", "comment": "Malware payload", "value": "05ae19aedf5c878e064522e977e8ee936cceec88b3ce82c84f0f6db1625ce77b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700509865, "uuid": "f062954e-59ef-49e4-9075-ac945400e32f", "comment": "Malware payload", "value": "8810fe47a6e440da18a78e1acb559dee581b3fbb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700509865, "uuid": "8ed7ab2d-3642-4fe2-a0b2-f6f2b2deb61f", "comment": "Malware payload", "value": "035bebf6aa222445f3dee554f600f3b88fac7a18ebba8662dd913b353f38eac93f5765fc30bf3d4929a30a44794471e2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700509865, "uuid": "53f1e190-a9d3-48e0-b063-3a4410c668c0", "value": "T17B559E71B502D037E1A101F5A67D9BA612A9BA301BAB08D7B3C05E3D95F2DC36235F27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700509865, "uuid": "2f575ce8-1b65-453b-8c26-a7d0b5994a0a", "value": "7482a1595744a3c77ac9461f3f27a729", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700509865, "uuid": "af6e26eb-81e0-42fb-a3d3-e7db55c5209b", "value": "24576:NmmEs2wqfcRBxJCBEmAMpCOJMbgp2kvB1Pj5R+d3ThJgrU35Zln2i6:8dw/IyPxbgp2iB1Pju3TIrK5Zln2i6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700509865, "uuid": "9cb418f8-6162-4314-9bec-d6e0be7a667d", "value": 1322494, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700509865, "uuid": "eab81b65-9841-4ddd-ba3c-2383f03d2086", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700509865, "uuid": "765a130c-f5fa-40b7-9232-6ecacd59c0ce", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15c9e1b2-87e7-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1700513706, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700513706, "uuid": "c7c3ea9e-23eb-4f1d-aecc-2a1a4df10e37", "comment": "Malware payload (RedLineStealer)", "value": "3772a518183915db0572ad0f7d3e95ea", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700513706, "uuid": "6ec1d37f-c4a1-44f8-9421-e77370dd4da7", "comment": "Malware payload (RedLineStealer)", "value": "06d468eb69b6f38d1f0c1f54badf915adedc4c8288e10ebc7479fd9b72d4ff10", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700513706, "uuid": "128861f1-f956-4cf9-b98c-c4cea2229dd4", "comment": "Malware payload (RedLineStealer)", "value": "2134cf2b9bc76aed896c0d421e5cc5e086515efa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700513706, "uuid": "7789e4fa-6c11-43e3-8633-9bba2d34e32e", "comment": "Malware payload (RedLineStealer)", "value": "1594a2b667b89246eae8a6ee609a05e6332040ca0817a941c9010f787b0c1751ca9669444225dc292e860ecd8a6ea235", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700513706, "uuid": "c11dd8c7-01cf-4d7c-900e-3e0854c9ad2b", "value": "T16AA422E2F2DD23D2D5D8833688177106877AB782420ECE0D5FD151E68A637216B37A7E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700513706, "uuid": "66bed9a1-f6f6-448d-abfe-c9b263dbdcbc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700513706, "uuid": "37ba10e8-dc9f-442a-98ee-d6b9f2417cec", "value": "12288:MytM48EzfvCeg3LvNvb3rnYXV5D83/HHnPwD:fqeeRvb3ryV18", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700513706, "uuid": "02ab29e7-ee51-487c-9e98-23bb056846a6", "value": 478208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700513706, "uuid": "44ea7040-f34c-4412-b11a-418894755312", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700513706, "uuid": "edce7251-e986-456d-9d72-116f802280bf", "value": "SAMPLE DESIGN DETAILS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81f48eb4-87c0-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1700497137, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700497137, "uuid": "31ca9ac8-0933-4712-9559-b1907bfdbd7d", "comment": "Malware payload (AgentTesla)", "value": "ca861b812e60ef5c718a6064158fcde4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700497137, "uuid": "5a176762-5553-4c6f-867a-a6ad76de578a", "comment": "Malware payload (AgentTesla)", "value": "070fded2d2243db45e66db242d451f7edc0f1b240bf75cfbe97ad703f8f80e2d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700497137, "uuid": "ba95f6bc-b67a-4c28-a83a-29a5df2fed61", "comment": "Malware payload (AgentTesla)", "value": "d9594283ad572a25c9006d94258f85bcdbb6c924", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700497137, "uuid": "481119e0-30f1-4569-b569-c44d25cf1d33", "comment": "Malware payload (AgentTesla)", "value": "79e2c6868d0e9af6510f49fd93bca743654ed8bec20f51e78e40b381139885997326a4de2105e0cfa73c55259c023d54", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700497137, "uuid": "e4b4437b-6beb-4bc8-9cae-f945de41bca6", "value": "T1DA0533416259D2935DB0BC94AA2E329CC358036E48F73E7A41A31733771E7AA7E770A1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700497137, "uuid": "2454a594-7dbb-47c9-827d-db5f4111f03b", "value": "24576:VW6tN/gRITF5Ug5rClPrYsTDT8nOB/jsaWBFK0YqAY16OiAtw:VW6txgRIrr6pT8OBrHWDAYIew", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700497137, "uuid": "06587603-bdea-4af3-b310-8dc5b6d8e98b", "value": 845723, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700497137, "uuid": "e1fcaed1-ec70-4827-bfc4-cda29b44fba2", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700497137, "uuid": "a91fb0bb-e49f-486c-a5d8-ecf47cb31a8e", "value": "QUOTE# REF 21654.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e29baba-87b3-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700491521, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700491521, "uuid": "dab3b671-175a-4d4b-b493-342270b19799", "comment": "Malware payload", "value": "fb33df4f8ea686baef87aefda2e45871", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700491521, "uuid": "955bba6c-451c-4ddf-9175-fc96c8fe89e1", "comment": "Malware payload", "value": "080c6383945d4d21ed71d4119823f970b3ab81120a5a4739d5b15e0e5102abdf", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700491521, "uuid": "db30c2cd-9656-4192-8bc8-f069b0f4248b", "comment": "Malware payload", "value": "3549e1ca96f393e0e025e02d881b4ba143ce851f", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700491521, "uuid": "1e0ebdbc-1256-4029-9360-be433d3ef62e", "comment": "Malware payload", "value": "5cd905b751f7d838351eb3eba8054423d560acee4dbd7159933526272e85e9ca980c4daa2701ae3b9e5004a61cb927c0", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700491521, "uuid": "e5a7bc19-06b9-451f-a4fc-4fd0c7207fec", "value": "T11356E020BB91C236D8B615B94DBEA399597EBB702F2451CB73C40EDE0E315E5AE30217", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700491521, "uuid": "46064a70-e888-45e8-945e-16b651c3b678", "value": "49152:6bezE8JYy3o+w+X7gJhHcnsZ9UwgV+UjgaSIDoncPieZo0g0IvHnfY:6bIJYBf67gHlUBV6jID1Zo0Ug", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700491521, "uuid": "f4bb171b-3be3-4f46-88c0-44c0fbb215d4", "value": 6291968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700491521, "uuid": "65693df8-cf2d-4eec-9a68-469d59ef452f", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700491521, "uuid": "953d5690-fa84-4e6e-9d0c-212f1b55aab7", "value": "gruppo.vhd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24b91363-87b8-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700493545, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700493545, "uuid": "f062fbe3-9392-4f46-98ba-af4b05a08d42", "comment": "Malware payload", "value": "5d69d088058a29fa9e2013311f3c723c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700493545, "uuid": "a23cebac-6aeb-4b96-a976-28b475d0d42f", "comment": "Malware payload", "value": "086d8f48191a2f42e6226f49c338a41c5e76fd7a1b2a302f839d6acfc609aec3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700493545, "uuid": "cb97c4f9-5314-4eaf-aad9-c049879d383a", "comment": "Malware payload", "value": "bca01e9951a596342503585d515d72920ffc49d2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700493545, "uuid": "38c187ad-2445-48de-bea5-e6a61ea4ab6f", "comment": "Malware payload", "value": "d30a438574c1e5ef9afa76f061dcd23ca8415a20ac2b39ca687c6389aefc4b419f41226f429decddf83cacb41fc6f877", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700493545, "uuid": "24e84e8a-5890-4f91-a1dd-c7b5f52a9e0a", "value": "T115B43A827D919433CC9B00771A98F65F961E5E040FA26DCBD364FC9A8F599C2AEF0325", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700493545, "uuid": "9fdde589-9304-463d-a326-90548b2399fe", "value": "186ee919e09209eaa8623fd1beafaf69", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700493545, "uuid": "ecfe0792-8069-4650-a442-ca553df3fc8b", "value": "6144:RU1ICK/fhsUVcTekSBEZ8/AAOQCm23MDWQBPxdDRbi66666q7B:C1IpXhsJZ16sMWQBblbeB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700493545, "uuid": "8695cba7-616b-4f21-8f77-c891e51597f8", "value": 505120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700493545, "uuid": "76432c8c-49b0-4ccf-a36e-86603b69ecf8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700493545, "uuid": "94b7f953-bc7a-4f21-8c62-c1cefa8bd199", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ada182c-8760-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1700455894, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700455894, "uuid": "d145dbbb-53ac-4f9a-87fe-0dcf60be5530", "comment": "Malware payload (Mirai)", "value": "2b07ec10ba463cd3a10ef115404fa56c", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700455894, "uuid": "78f16b90-ce9a-4ce6-8dac-a9c82670c4e3", "comment": "Malware payload (Mirai)", "value": "089a580f35efcde7ec999413aeeece8493d7d4c93213ed5d9e79b6a763980fe0", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700455894, "uuid": "7c08265c-a164-4cab-9f65-9089f576e42d", "comment": "Malware payload (Mirai)", "value": "9d647f9bc6982458926d9dd69ebfd0b96606b347", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700455894, "uuid": "53c2fbbd-45c1-4f03-b88a-a549ee64f8e8", "comment": "Malware payload (Mirai)", "value": "83cd66548e4bbe003bfcfffc4943f5bb0e04d77c0776574491f308ddb226faef5369c01e981e285ff2e03ba7b3c336da", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700455894, "uuid": "ae8cb467-d2ff-4f88-93d9-084f40e04615", "value": "T134D30945FC405F23C6C612B7FB5E428D3B2A17E8D3EE720399256F61378A95B0E36642", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700455894, "uuid": "2f1e9eef-b748-4c25-a50b-f5f879b28245", "value": "1536:trDIYWd83UbTbzdASIQFb7Am6H4V8h9/TZY0r8OuUpkzw9BElBQxwywDF2ftnoJu:RDIdBjRFb7M4IBlY0r8B89U9nM2bU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700455894, "uuid": "103ae706-3022-4b44-8e33-db757264e504", "value": 133888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700455894, "uuid": "1ffa0dd4-6fc1-40ab-a151-8bd20f48807f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700455894, "uuid": "2a05acaa-932f-4b21-9c4c-5b9c1a8d638d", "value": "top1hbt.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40a26c32-87de-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1700509913, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700509913, "uuid": "b54b8c44-de8d-49cd-8f10-3920253b4f43", "comment": "Malware payload (Mirai)", "value": "68e831bf673b641264f334427e6e1c7a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700509913, "uuid": "31f2e3d9-88a6-4645-ad3b-59bf51c4701b", "comment": "Malware payload (Mirai)", "value": "0aecea49d081df60cd07cde88925d958522af07b10441c16ad2acfe6d85ae12e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700509913, "uuid": "e017243a-2f69-4283-ad75-4863e5c8f1aa", "comment": "Malware payload (Mirai)", "value": "e3998bc31314e70da1addcc0281a47645c8ffce6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700509913, "uuid": "8434875d-3979-46f4-bf9f-a29cdbf9c57c", "comment": "Malware payload (Mirai)", "value": "7a65b9606dd0427994b0de9ebd6be5ec66e8c7cbe9360a37b25a985b82a01e4f088ba9a5c63bf7da8da91d00edb999d4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700509913, "uuid": "77f5f8d5-e91a-4ded-95f6-df09ca7f1f60", "value": "T138F2F10EDB9945A3EB8F13B9236FE4F974825621331D893A9DDA7EC42B7301C19A8531", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700509913, "uuid": "1b783159-193a-49ed-a75a-5f8f581cf214", "value": "768:czuIb/CcvSoM0Ukk8PWuEfwNVJhehtoecfKoVomIpFgXB3:XIb/Nao97Bed45hwoRfpymIpmx3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700509913, "uuid": "85dbf9a1-1bb2-43eb-988d-900b2e7aa052", "value": 36912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700509913, "uuid": "ac3cca52-2bbd-4dd9-9dd2-6b2f6b52fc32", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700509913, "uuid": "05fe51b5-ba5c-4db1-ac2e-537246a18309", "value": "68e831bf673b641264f334427e6e1c7a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6902c77d-87b7-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700493230, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700493230, "uuid": "c07f1a0c-21fb-49c6-bba7-1955649e1ec2", "comment": "Malware payload", "value": "3e40919e6f2125376062b90cb8b9f669", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700493230, "uuid": "23720a24-9f1f-47b5-a40d-5e3f4695e6dc", "comment": "Malware payload", "value": "0badddf41c8f5dc1a17e07fbc0b409094afa00a1f87ea791dce0be5dfffbc4ed", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700493230, "uuid": "ff7eb2c4-e809-4b2e-b15c-5555cadfaa0c", "comment": "Malware payload", "value": "81d603905adc0a987d044c24e9dc1cbf3f69b489", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700493230, "uuid": "0e33dba6-26fd-4fd2-9ef9-e2396b15bbe7", "comment": "Malware payload", "value": "7a1c9873741952cb6323563d6cdf6ae2ed0044740b78e42b3089ab526072e0cd6786749c02e30c94114415e41719e034", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700493230, "uuid": "87716191-53ab-4611-91d6-9cf904bfbd7a", "value": "T1DC4633852EDE64AEC8DE7478198ABF6F72BB2E7905508E0B5C757FC5AC3348485B2103", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700493230, "uuid": "b93ea3cd-33cf-4fea-a438-39f00f77ca4c", "value": "1d7b3ec6e021fdb8eb5d7101ac8398e0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700493230, "uuid": "704c29b0-9135-47f6-a00d-cae0110ade15", "value": "98304:LDDpKP4VkSQq4FeK668YNA95zfx6J2z6ANu23eL06ZMMG2dTyqF/b6OUV1:XVa4piD66NNmz2m6xl7HJ69V1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700493230, "uuid": "cd332c26-a45d-44b0-bca5-672d078badce", "value": 5810328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700493230, "uuid": "5339d134-0ed6-4063-98ff-aa570ed0a67f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700493230, "uuid": "1d87ce41-d520-40ea-bf49-18faae7c8ff8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7050170-87a7-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1700486596, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700486596, "uuid": "8ff3246e-3c0a-4a90-8396-cc3daece8d66", "comment": "Malware payload (AgentTesla)", "value": "a6bb29a36c8ffd7c0266e856b8ab1a00", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700486596, "uuid": "ff93ce6f-4072-452f-b5f3-815bdae840ce", "comment": "Malware payload (AgentTesla)", "value": "0bca75e8f177577b1b44375eed8f4eddf8d64214f77297e58bd5647c1f8132b9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700486596, "uuid": "089e4d01-0d99-44c1-a5a9-841c8b5f5150", "comment": "Malware payload (AgentTesla)", "value": "4a6ed39f497233e189c7450a483bbf47ac2ad26f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700486596, "uuid": "f5ad676d-f879-4ea9-964f-e4f6ce3284f9", "comment": "Malware payload (AgentTesla)", "value": "bd9469794995808381b50f5d0b3e88a2db62b08a26aacd3eec07102eb834d185bf5b219f30ece282688d115fb410a481", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700486596, "uuid": "98b8f2bd-c748-4af8-b074-01fccb45bf8a", "value": "T18BB42354AA9E43F6D1D56FFA2883520473BAED4BA11DCA6C2DDD03CB67A1F035D02722", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700486596, "uuid": "66062a8b-f7c1-4a37-99db-39b8bbdfd1d0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700486596, "uuid": "63904a6b-3f46-4f2c-b641-338d4a387c49", "value": "12288:6vCeQakpNeHau3YVxUguatdvI1Jtoc0Nr9DSL0wJyb:6qeQapoQQI1joc0HDSL94", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700486596, "uuid": "23169f72-2590-4925-8392-689b63be5292", "value": 512000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700486596, "uuid": "ec2a47af-c2c4-454a-aa24-8769e6ed294e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700486596, "uuid": "3080fbf7-c625-4a32-a0ff-b76c719adfb9", "value": "newpurchaseorder_14112023.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47bc23c6-8786-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700472129, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700472129, "uuid": "cfb3e236-5dce-4733-a554-74e302494540", "comment": "Malware payload", "value": "072c3199ba451fcfc9eea4d87f000ad2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700472129, "uuid": "6e7c0d2b-9b09-43a7-9a0e-88f155a068fe", "comment": "Malware payload", "value": "0bddc6655ba739d631907c6b5063348789dd75356258f5aa846907342e77bec4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700472129, "uuid": "b2217d46-6dd7-44a3-bbfc-3778843dc539", "comment": "Malware payload", "value": "fe7990138d2c5df16eb407fd9cb828b7dad6430a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700472129, "uuid": "70e9a1a6-bb5d-4f4e-bf1e-7d1680ff6a01", "comment": "Malware payload", "value": "7d79d2f94ceee92cdcb3efef1587cb1a94ddd379f36f3cdad32b8a6ac70925aa2d65091429aff1ae483efadfeda66f2f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700472129, "uuid": "bc54c95d-1f1f-4408-845b-72519b91d736", "value": "T1726419989349AAE7D5CE0B3790C27B5587B0D126A74EE30A3C881AF65C167FE7F46043", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700472129, "uuid": "0b5c25f7-af9c-429e-bd33-47f0ae453124", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700472129, "uuid": "664797f6-5eb0-4e14-8aef-b06589115a4d", "value": "6144:1oyZPhx6QTSm9+Vzq6PH1c2f6jTy3gNDzqiDe45XuvPpb8FuPdQSiiKsZtCqi/A8:NT9aH1c2f6jTy3gNDzqiDe45XuvPpbpe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700472129, "uuid": "7a8ba771-fc4b-4c7b-a3f6-3d81a1be9b9d", "value": 323072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700472129, "uuid": "d9381958-b8bb-4644-8b4b-f2c440684d4e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700472129, "uuid": "42fff281-7de8-4e1d-bd05-2f887ac6af9f", "value": "purchase_order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20c60c25-8774-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700464333, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700464333, "uuid": "fe2a488c-34e4-43af-aa5a-8c9160ece592", "comment": "Malware payload", "value": "40ce0b5f077916ed9defb60809ab4b8e", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700464333, "uuid": "31c47e24-0035-4a1d-a80a-9d45356deb19", "comment": "Malware payload", "value": "0c2d3bb028c729f96e4338566577cfd390b0ea6cb28684d807d379a6a6839fe6", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700464333, "uuid": "5ae8688c-856c-4ee1-a47a-fd4389fa96ce", "comment": "Malware payload", "value": "0ce8512d930a1ad3077ae485a962d97be622c566", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700464333, "uuid": "8e8682f8-c20f-49e8-92f7-8c229d81c538", "comment": "Malware payload", "value": "05abb7d47338fa92f874fdfefe24ef3121a6d5fac43e6e88870daddcb2b6a835bee4424acafba9855f3cf65cfe0f6723", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700464333, "uuid": "664718ed-a2d6-4e63-bfdd-e71652521728", "value": "T14A5302D44D9EB1E6A3F783F3A13E86700FA249B225E739DD3C78184A7987F192150A19", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700464333, "uuid": "635948ab-a9fe-488c-a0c2-37af6a4ac0d2", "value": "1536:XYMZHl+0TnDdwtpdeHaQb87HdBBYpxzYwIIFLRfQ3W/:XYGHQ0TDdQ7MCBBERYwIIXQi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700464333, "uuid": "776587d2-f221-4636-94b6-464dd88f5f1d", "value": 60920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700464333, "uuid": "a424cd46-f596-40c8-9dd8-6496e7d1e503", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700464333, "uuid": "0796342c-018a-4907-a1be-0b637a43156a", "value": "proforma invoice.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec703447-8752-11ee-8907-42010a9c0042", "comment": "Malware payload (IRATA)", "timestamp": 1700450071, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700450071, "uuid": "83e856d5-54de-4d24-8dcf-c4e4530dcecb", "comment": "Malware payload (IRATA)", "value": "212b9c30e66bcdbe07c8e03cfea2f504", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700450071, "uuid": "15707697-a186-4567-8359-b2d26719a2ae", "comment": "Malware payload (IRATA)", "value": "0cb96aa4ef5e80a0bc1bb1fe2ac92e137d80aa42674b62a3e62d32b06cf8109b", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700450071, "uuid": "e6fb4ac9-e714-430c-bc83-54774b044a9f", "comment": "Malware payload (IRATA)", "value": "09cc44e8f808d286a2944d507535b9253f504c65", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700450071, "uuid": "646e1c10-7168-4681-ae51-807ca350168c", "comment": "Malware payload (IRATA)", "value": "689c2cfa01813cc891ad603e2bd4d5415747d86053c9e65a1d21f0f2ffcef07ef6c41d98297be73b7fe563b5e3c74ee8", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700450071, "uuid": "4cfaf7cc-3123-49eb-a3cd-3d2ec4a75a74", "value": "T112D52393F365A82BC8F6C33222A4163A143B0D659783F385294D77FE28B7CE84B855D5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700450071, "uuid": "c7b817d9-2e74-4b13-b155-afd09e2874dd", "value": "49152:si/ehovnmoH4ix8ZtAtoRBH9HjZys7EWZ6mtieKJ35+JEW/BYEbb6vYqo9s6prW9:JXeoH4LDAtiB9MRWZb7o35/iBYEbbKYw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700450071, "uuid": "b68a8352-e98a-4ef0-91cb-72a439ba1245", "value": 2814020, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700450071, "uuid": "2ef88041-2c64-43a4-b97d-2626253680de", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700450071, "uuid": "06668749-eb58-4e2c-bfe2-0f2e73e0cf4d", "value": "app.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1a7f7b1-873d-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700441007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700441007, "uuid": "82eefb5d-d5e7-4470-9f76-733fb5b707ff", "comment": "Malware payload", "value": "84e4d5506503a184155e66538c2b36cb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700441007, "uuid": "042e904b-de1d-4b9c-8e0d-13978f14d32d", "comment": "Malware payload", "value": "0d0731764780ddf2f2f50e607c152c59583ff4664b86f294fac3a8fbf07fb94d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700441007, "uuid": "2f3a36b4-4a46-47c3-b573-5294b101434b", "comment": "Malware payload", "value": "d5be6e50616ec76abcc6b7d8b9ef324887a51f7c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700441007, "uuid": "a7227856-2e12-4fcb-928f-3e151831fd3a", "comment": "Malware payload", "value": "15b6ec8749fb0210d6377e1ace9c508a32bc32f0bc628dbb4ee8d69046440dccba22fd07e47d4d36d93bf2fc2ab233be", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700441007, "uuid": "223b2345-b55a-4501-af9c-daad5bf3ab53", "value": "T1BE559E71B502D037E1A101F5A67D9BA612A9BA301BAB08D7B3C05E3D95F2DC36235F27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700441007, "uuid": "2c9f13a4-aeb9-49a6-b4d5-0f156fc95e88", "value": "7482a1595744a3c77ac9461f3f27a729", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700441007, "uuid": "0a1a1d98-f4e9-4d42-9254-d1fd0db356b0", "value": "24576:NmmEs2wqfcRBxJCBEmAMpCOJMbgp2kvB1Pj5R+d3ThJgrU35Zln2i6:8dw/IyPxbgp2iB1Pju3TIrK5Zln2i6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700441007, "uuid": "7d4767bd-e9f0-4a81-a8e0-adec18873b02", "value": 1322322, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700441007, "uuid": "e8c3441c-3577-4fc3-a1e6-6577e458334e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700441007, "uuid": "7ce1aa1b-fc52-431e-9d60-7ae51d1457da", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16d70507-8781-11ee-8907-42010a9c0042", "comment": "Malware payload (EpsilonStealer)", "timestamp": 1700469899, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700469899, "uuid": "9520e544-fa8d-43ce-ab00-8cde9062bdeb", "comment": "Malware payload (EpsilonStealer)", "value": "a7d32278018ab365b2bad7d9ce298cf1", "object_relation": "md5", "Tag": [ { "name": "EpsilonStealer", "colour": "#559F06", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700469899, "uuid": "b80431ee-c066-4e71-a5bb-f06e68680ed4", "comment": "Malware payload (EpsilonStealer)", "value": "0d19d40ff767e99b383fd72e4c3052ab5c68d751b9ece784ef53423bf940028f", "object_relation": "sha256", "Tag": [ { "name": "EpsilonStealer", "colour": "#559F06", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700469899, "uuid": "f3bd761b-0c40-4ddd-be04-f7a616948172", "comment": "Malware payload (EpsilonStealer)", "value": "5770a7d641c8e8602835e7b56f080d7f12358d8c", "object_relation": "sha1", "Tag": [ { "name": "EpsilonStealer", "colour": "#559F06", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700469899, "uuid": "600f875e-da04-4e60-9fb9-22f5a71bf886", "comment": "Malware payload (EpsilonStealer)", "value": "a1b4450cb8ca91a649f0edad827f8b395a811b223bb55e2f9e5f2ce5f81ea42279640665c1666d05cd9ef8eeed14bc3e", "object_relation": "sha3-384", "Tag": [ { "name": "EpsilonStealer", "colour": "#559F06", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700469899, "uuid": "4e533094-f1fb-4b51-8b2f-aa27bfa5368f", "value": "T1A6E73345FA42B173DC43AE37C9AA5BD99A04FEC17320D6431B48D7F96A035A44E818FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700469899, "uuid": "3481c51b-1335-4a80-b612-c8a567b57118", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700469899, "uuid": "ed304991-ae1c-4a30-85b7-703aa48f0c1a", "value": "1572864:4m6xMPHCDfXpcY/HPLDkYDO37J4JPnMOKwZ4ryOp0DfNcSwa:b6x7qY/HPHlC3fwZiy3fea", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700469899, "uuid": "afbcb612-f1f0-4154-960d-a5bd47c3d7ba", "value": 64908198, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700469899, "uuid": "02516d5e-f1d1-446f-a94e-70ad40fb65fe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700469899, "uuid": "dd45580f-a14a-4330-affc-5582d9c4f18e", "value": "a7d32278018ab365b2bad7d9ce298cf1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19f831c3-8781-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700469905, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700469905, "uuid": "7fee4a71-2dc3-499b-bf15-4139665bfcc9", "comment": "Malware payload", "value": "479cc0341d454566a717cc01925fc5b9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700469905, "uuid": "b662e02b-c3f2-4fbb-b6c6-0ad2db0f5fbb", "comment": "Malware payload", "value": "0d4efcdc29091a1b26999b4124ffcd076d5ffb1fe6a568ded657363aeb9d1a29", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700469905, "uuid": "fc54145f-b6e2-42b8-8535-f5b94dd5f454", "comment": "Malware payload", "value": "1abe531b26d3a167ffc74b382dd733991a92e5a5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700469905, "uuid": "37bb2753-a043-4059-b748-c82a7c2d8577", "comment": "Malware payload", "value": "a10064edbaeec60ebaf9395442c87f1ab7d066751a02b992184d5d7edf26b21e0639ece93e9fcae4c524669468ae440e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700469905, "uuid": "5bf44e8c-282e-42ff-a4d8-8b7f3fe7a4b1", "value": "T1D7A47B9239C9716FDC2F4A38035FEAB22A795CE07391496E4F80360D5C3664A90EEDD7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700469905, "uuid": "ba0940de-f394-42f5-96d4-bf6fb7c7c89f", "value": "6e7f9a29f2c85394521a08b9f31f6275", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700469905, "uuid": "b286d17d-b1a4-41da-9d53-2ff319696e62", "value": "6144:7T4DtDPZVheNA+ff0hEgzsTMO2tpiRGPjESjRJn4MYBM5uqK75VF:7T0nhe2ekC58jxn49BUuqGVF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700469905, "uuid": "3048eb07-adf1-4b84-8548-f939ed7daac8", "value": 451640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700469905, "uuid": "ece374ba-a29c-48b1-8a69-4d67b0487870", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700469905, "uuid": "01d013af-785a-401e-9fba-f48e90d82a37", "value": "AREO FEU PAGO FRAS 5094 1573 4465 1231pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca07c0bb-87c5-11ee-8907-42010a9c0042", "comment": "Malware payload (RemcosRAT)", "timestamp": 1700499406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700499406, "uuid": "b2496f59-a926-4c0d-a6e7-c82ce5ca699b", "comment": "Malware payload (RemcosRAT)", "value": "2a138508a3f7ad82efdeaaf2fc2e44b8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700499406, "uuid": "47252cee-28fe-480d-a926-8865ea94783d", "comment": "Malware payload (RemcosRAT)", "value": "0dd1595e59366de724e13ddb1df995698e62cc62a3b975eee3b0943352d2c1fc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700499406, "uuid": "54a83ec9-0d84-4fb3-b75d-0189da2d0f69", "comment": "Malware payload (RemcosRAT)", "value": "af000f491f22fb1903f7ade1dad025ced9fa6a54", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700499406, "uuid": "66947aab-aa48-48d0-a830-edb6e23fcc21", "comment": "Malware payload (RemcosRAT)", "value": "bf127c5540dff556f5733ce0033942aa46022b247241c8bff123b6e9080901d7c5044715922aa65751f2c7e7e7cb8382", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700499406, "uuid": "c735f6e7-b82d-4e96-b5d8-4b262bcb94fe", "value": "T1996402B1B3A1E463E1F317305926A6BD6BE57C1338979B0A33413B2DAA73703671E506", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700499406, "uuid": "7b54d506-a1e3-401c-9c2c-9ca5d07dcb21", "value": "6e7f9a29f2c85394521a08b9f31f6275", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700499406, "uuid": "cb7bb596-4d3b-4c57-ab5c-20b1becf6867", "value": "6144:h3hqL36MLuSGP5cBl32nKaGstWs8soSoGhMfA07X52iWKmLrCBZ0O:h3l1ofaGxuoaR0LAdJWj0O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700499406, "uuid": "2350f95c-30d2-4511-a6eb-624df1943284", "value": 324309, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700499406, "uuid": "77e8e945-4ab6-40c6-a98d-1b2e4c4f7b67", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700499406, "uuid": "9a9ce3f5-6064-45dc-9432-59893efa96ab", "value": "2a138508a3f7ad82efdeaaf2fc2e44b8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d633658a-8793-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700477951, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700477951, "uuid": "47aa7a3f-7d3f-47a9-93d6-1acb87799153", "comment": "Malware payload", "value": "94d09d0b19fa2a27ee90e02cd69bf51c", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700477951, "uuid": "55ccdd24-29a8-4c34-a6ff-61f752bf22a0", "comment": "Malware payload", "value": "0ddff43e7a3ae1e83616c55ae7b9e31257d42ec84db434e7bdcc0e94df2b207b", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700477951, "uuid": "076e9400-633a-484d-ba59-d3afc9567cc6", "comment": "Malware payload", "value": "4ba40424f354df03f4aa49b536db78fde095f34c", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700477951, "uuid": "805eacb7-d750-427c-b714-915f4cde961a", "comment": "Malware payload", "value": "f15f548f0bf85fe64d505639aeecdd02e080c017c537ce05441e910569b1a084e54eaf1584ced4caf63aefe299f15d65", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700477951, "uuid": "439dc523-6017-4840-be1c-759e86345234", "value": "T15CE07D2DDB601515D3AF64F71C673331FF562024589653831AE612240D014B21E3114C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700477951, "uuid": "4f730bc8-e292-4363-a072-58b17b99f29c", "value": "6:5jfapMsG450eGAVler97zdTQPlq7v0H0AHnm2rtXapMLj450epdo/t7t+lH:5jfapoZrZzdOlkcFapc8do/t7taH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700477951, "uuid": "48edcd38-f271-47fd-9231-d93cda42202c", "value": 343, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700477951, "uuid": "1306373d-96e4-4bde-8fef-5d308165e6ab", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700477951, "uuid": "022e1ebe-617e-4012-bf35-0666f51c0d1f", "value": "Amministrazione.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71a314e7-87b3-11ee-8907-42010a9c0042", "comment": "Malware payload (Loki)", "timestamp": 1700491527, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700491527, "uuid": "598c54e2-975f-4924-be7f-e823f95f2bf6", "comment": "Malware payload (Loki)", "value": "3eb25c28d7ecb52aa54c854745eee341", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700491527, "uuid": "ebc9e02a-994c-4139-9685-6e6cf868bbb0", "comment": "Malware payload (Loki)", "value": "0e0c63ec111782f4a9b11ee4eb9ea65341b4b893fa7f46138bae2495302afad9", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700491527, "uuid": "84562309-9111-4596-8336-015f61913116", "comment": "Malware payload (Loki)", "value": "07eeb842c1d0f0f38d489b4ae3a927add65633ee", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700491527, "uuid": "62f8cb56-b4d4-4e80-bad6-f92714421dc8", "comment": "Malware payload (Loki)", "value": "62e154da6798993fc5c4adf7a61fcfcbc85a9d455caff7d7524839ce59b3df15fa84952c7322306b6b472407004dd315", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700491527, "uuid": "567d4f67-3534-4e36-b5a9-4e31b5cb981b", "value": "T137A423C34E7DC7ADC71612AF63ADE3CA54A43DF9D69642128ACBC94710B9ED08E3C119", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700491527, "uuid": "015abb2f-b452-489b-a6c3-ebe27d77b21b", "value": "12288:wcDZu1aQ38XjP1C34XUQ6GmRM4FKZJJe2:PmaQ3UubQ6JKZy2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700491527, "uuid": "e16e9cc0-79ff-44ae-b685-4d35f5d94670", "value": 458604, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700491527, "uuid": "528541e7-cf1d-4c88-8367-7d6f691e18c7", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700491527, "uuid": "efe41907-a196-4cb3-ab5e-00c954c058fd", "value": "nContract List.r00", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e3d3403-87df-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700510392, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700510392, "uuid": "3935f365-fd66-4cb1-a85b-d57e425a2b9f", "comment": "Malware payload", "value": "eca619ab86ce847e6624d36bc2689e8a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700510392, "uuid": "2d7c60c9-3bd4-43ef-bceb-a4dd18ff57a2", "comment": "Malware payload", "value": "0f53475c9c40a3e4b326b72976693a76c92f035e447a91f005f48fe51b56c401", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700510392, "uuid": "25f34d6f-5ebb-4ab1-95a1-bf03a1d2cc14", "comment": "Malware payload", "value": "6b0db996686efd49b76a96784b2e2fc645554ba3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700510392, "uuid": "33f47b05-0963-4cfe-b8ce-44d57b46f03c", "comment": "Malware payload", "value": "a6f7cf9b915f9bc5d723529eaa2fda92df62cd85b44890f9524686e2aea3ba608f942e399081082d7d4fad67d8326868", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700510392, "uuid": "ec50a214-8186-4136-ac57-53d5e0d74fca", "value": "T103763321B2F480F1E61D153196A57FB9A6FD83880F3147E7BBD4010E6AEB6B6506438F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700510392, "uuid": "c1eab618-0a48-42f5-a2b2-e4ef5cb77de2", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700510392, "uuid": "4cd5b1ce-3dc5-403d-80fc-1aaccdff62db", "value": "196608:91Or6v3zMQx+R/x1M40dwD75eM4I+tTWHI2y:3OO34Qx+24fVeM4I+tOI2y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700510392, "uuid": "44be66de-7c05-44c7-96a1-133968673042", "value": 7480535, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700510392, "uuid": "91034c7c-6133-42dd-9cc5-776bca425488", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700510392, "uuid": "ead93caa-c1ae-4d25-88d6-5ee4fa84e2fe", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58485325-87b4-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700491914, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700491914, "uuid": "3743c563-d5c4-4a0c-8277-fcb9c0bae5e5", "comment": "Malware payload", "value": "649b193af588ee068d712f11c0f04947", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700491914, "uuid": "8f302c94-99c9-4a7e-bed0-71d87d20a126", "comment": "Malware payload", "value": "0fae12823ebe54ad046f85c0e3336f8bd78da65cdf3f4e5eebd639d70c650dd6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700491914, "uuid": "626269d5-71f0-45c1-9148-a25b409caf3c", "comment": "Malware payload", "value": "adc8459fdd6b8b28061f9948deed55b0f7b6a89f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700491914, "uuid": "1f940614-3249-4697-819e-9abda93b3bb9", "comment": "Malware payload", "value": "910d4c43d855c00be2a2083ade87533fadcf2c17c445c1194513f3d3d021a6039a71aae492f7384578090316a9d74591", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700491914, "uuid": "c590b3f4-fcab-47fd-a994-620dad1e01cc", "value": "T153E4124966560B22DEBA13B684120F494BFA61BE747EE734CCC7E08DB785B42D510F2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700491914, "uuid": "5fb90473-15bd-45d8-b2bf-f0f4e7e544a8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700491914, "uuid": "6e0964d6-1c1f-43f6-8d53-69d083453256", "value": "12288:ieQXucvCeAeQseQSLIsNmNDgjwt5ar73gLsFK/poIWzZuEDhWklYCkwWdqbPx3V:ie4ucqeAeteQdg3wLT/poI+DhW5wWdiP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700491914, "uuid": "812f7b81-8494-489b-ab05-4421ceb7ac50", "value": 698368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700491914, "uuid": "8184ec3f-6f61-4f91-8b21-4fa2b64d9a17", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700491914, "uuid": "e81fc0c3-70ba-4533-ad67-99737ee8960e", "value": "Balance Payment.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93d97abd-87ae-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700489436, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700489436, "uuid": "5f9b2d61-1190-4197-8573-352a6054036a", "comment": "Malware payload", "value": "ab51e4a0fcd13d7c113490fc3a9d6044", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700489436, "uuid": "2b1ece36-5665-4988-aacc-75cbc987f463", "comment": "Malware payload", "value": "110fcaa965db95c77489dc33288a0453ad9dc4048168606eb278d0f89e007cda", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700489436, "uuid": "b7aeb206-a2d4-4188-9668-793a39858483", "comment": "Malware payload", "value": "65d503438b8d68dedacb37d863644ed8cc8bf7a4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700489436, "uuid": "a8ad6c7a-a175-4731-8f0c-f5cfdc71689e", "comment": "Malware payload", "value": "08f44fc4854fc9514ee0af9d6ce35864ba5fcfbd8c28b9b00e43ae8d01316db332417e68ba99164587d835931dad145b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700489436, "uuid": "bfe20aca-d6d2-426a-ba17-14e7602b00b3", "value": "T11114AE2177E1C032F26B493049B2C2A19A37B8629B71D7CF2B840A7E5E357D1DB79316", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700489436, "uuid": "167aaedf-449e-4877-9150-cdfffbd77c08", "value": "b759efdfaa2b106a9868739336fc4103", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700489436, "uuid": "9c39852f-b398-48b0-b65f-2610fb59bc59", "value": "3072:aHArHVUDwY9mwOLyPLWkGQ48ejnbVoxinZKoXQUCp:xKDd9m/LYSkmbWkn3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700489436, "uuid": "bb4ed0b7-3d12-4faa-bd88-ef7845c47e50", "value": 205824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700489436, "uuid": "bde38627-548a-4c26-9f4d-5dbc0c800599", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700489436, "uuid": "73a6a2de-284a-4a8a-a5db-42df16272bff", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "593b57ff-8780-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1700469581, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700469581, "uuid": "048f9fa9-f9f5-46fe-b2f5-37b1e6555d9f", "comment": "Malware payload (Formbook)", "value": "b397e39c3a79942b9555854a77067778", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700469581, "uuid": "7de9d84a-087e-4b2a-a6f4-f19b15bf6371", "comment": "Malware payload (Formbook)", "value": "11e5a9ba0272bcf0b50d5405077c6462e1fa241ef007a1b4e04f546bba0b0dc7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700469581, "uuid": "afbc926e-7372-4e2d-87a7-a982ab7e9010", "comment": "Malware payload (Formbook)", "value": "50d9604de704fccd353fe75f52dd4f85b3593168", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700469581, "uuid": "e5dcb52f-a77e-4c0e-be26-cb3e05781961", "comment": "Malware payload (Formbook)", "value": "6241e07c71f4d39f4f9f3da93d0fdd5244e8806d74f650b8a9c4f2fb43ef1772a497cfbe82f475aa32a3ba76944b4c59", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700469581, "uuid": "3bd38303-81e6-4703-bbf0-e868af76b31d", "value": "T1F605F7BF6B8C213780B9D697C3A3E066F27FC8A7723A5E2524D3DA914647A0774C521C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700469581, "uuid": "27127d2c-fae5-41f3-ab5e-a1fcbf64c894", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700469581, "uuid": "712526ec-f39f-4d09-9521-d5ed146f2eb0", "value": "12288:ZB5DAv7VKDl1G8J5BAWwD/4RxIRLUPvqggto1qBmy3J6nB8duwCrLhMPr:ZzDUVH8NIgzYLOvqgNamy3J48VCBKr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700469581, "uuid": "60aa9659-ba26-4a97-9159-da73a92fae35", "value": 799744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700469581, "uuid": "ac747e2e-03dd-4f56-80c4-f1e2bcfa08f4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700469581, "uuid": "55d8e812-2325-4e9b-b7c9-acf582cc3edf", "value": "S00989282313413.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dcf34d1b-87c0-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700497290, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700497290, "uuid": "b28078b7-2745-4a73-a6a5-cc201a56c39a", "comment": "Malware payload", "value": "cf9a1d449539094ee40801c3f4f6363f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700497290, "uuid": "c9cc9c95-dbeb-40d3-9843-5d03e482f899", "comment": "Malware payload", "value": "11e78ce96eca49bd61cef41e06038ca25d93d8b6e8a34c0387cb38221d8c244a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700497290, "uuid": "73f7340a-c4cc-4b31-9bed-4b9ba4c545c7", "comment": "Malware payload", "value": "56693362bc4b960756835f850c949613277c91d4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700497290, "uuid": "f9c7009b-89b9-4d4f-bbae-e9d66e064345", "comment": "Malware payload", "value": "ecdf05130d14b716e900629d99598d5d1c3418b4a1a1f041d4e5ab19abde8d67750c9bde80d3f3cdfe7221d04ecf48ff", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700497290, "uuid": "95a38c35-8386-45d8-8af2-73509df43772", "value": "T1ED559E71B502D037E1A101F5A67D9BA612A9BA301BAB08D7B3C05E3D95F2DC36235F27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700497290, "uuid": "3221827c-31ad-4456-ac56-fb11df1364b3", "value": "7482a1595744a3c77ac9461f3f27a729", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700497290, "uuid": "23e5dfe6-3b10-4282-a371-880197aae7c1", "value": "24576:NmmEs2wqfcRBxJCBEmAMpCOJMbgp2kvB1Pj5R+d3ThJgrU35Zln2i6:8dw/IyPxbgp2iB1Pju3TIrK5Zln2i6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700497290, "uuid": "80f0e463-c7f0-4f59-9935-e44485db5593", "value": 1322463, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700497290, "uuid": "a6e8b9ea-3ec2-467d-a164-aeb22b6c98f4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700497290, "uuid": "020c1016-d26c-40fe-8ab6-90797fe5cc12", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f91393a-876d-11ee-8907-42010a9c0042", "comment": "Malware payload (Smoke Loader)", "timestamp": 1700461485, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700461485, "uuid": "e8f60277-bf20-4352-a0ac-66bf214a9225", "comment": "Malware payload (Smoke Loader)", "value": "a9c5d3db8ea47ab1e03cbf5a91065d24", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700461485, "uuid": "c196fbe3-4516-4b8f-835d-6eb8db1c8a1a", "comment": "Malware payload (Smoke Loader)", "value": "121a9ea644073f820645f34c67bd159aff5a29cec51269cdc07bf4dad0249f30", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700461485, "uuid": "4c29cc21-2355-4dbe-80ce-eddf88fcdb70", "comment": "Malware payload (Smoke Loader)", "value": "5e01d907db57d5f12410bc1743d37b803cdaf29d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700461485, "uuid": "21ad43ed-47ea-47b2-8e1e-71d20ebe4029", "comment": "Malware payload (Smoke Loader)", "value": "9cf6d746445a8531094f2577e402d1a47d96b28ac07f8bb944fa4bc9f650f2fdf58deb6ba636bc54e66b2254d5298a76", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700461485, "uuid": "ca2cf3d7-0e78-4dea-9b63-fccb1c49c09e", "value": "T165D62275B36FC917F0F36E648406BFEB61B367B1BB19216964281EC541B8B31A0A4F13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700461485, "uuid": "a353b9d5-87a9-4fb6-aa42-844db6b36322", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700461485, "uuid": "dacb2dab-3e58-437f-b36d-be013c5196ef", "value": "393216:FmL5LvPmm1SPtqMOL7JTa/l8ua1ipeE/Dl3uh1:FS5jXMt3OL7ta/mtJgDlez", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700461485, "uuid": "e6f0e054-2046-4cf1-91d4-1937df9fd20c", "value": 12760576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700461485, "uuid": "ff472738-23c2-4217-9c56-901285398909", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700461485, "uuid": "87e67f28-13b7-41ed-854b-0c3e5cb6af62", "value": "a9c5d3db8ea47ab1e03cbf5a91065d24", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4132ab9-87e0-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700511019, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700511019, "uuid": "9a1e0cc5-8013-47b4-b685-54a02cf50a59", "comment": "Malware payload", "value": "295a692c31ac9db116fa6f4c715aafb1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700511019, "uuid": "9843392f-2c59-4da2-b594-136adb652b20", "comment": "Malware payload", "value": "13e767854d12c3a62a83c90839d9b3041fcca033c06ae1452de9704886e4948b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700511019, "uuid": "ddb16459-efb3-4ff2-84ce-881a94db0e55", "comment": "Malware payload", "value": "72cb7acb3c493f8e2c835a1d7f32b09fb394c8e8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700511019, "uuid": "0eb01dab-368b-4a46-9a4d-0a157151ed44", "comment": "Malware payload", "value": "b3c564175ecf691f018a244bdaeff2277e1bf4ace3472c6369facf6f1446c40ae6183352141eb2d1e0e37d2d76b1db97", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700511019, "uuid": "79983156-dafb-4360-8f15-826344081f86", "value": "T1CE74CF89A5D6DEBAF6D43376A1618213E226810081EFAFAD67D143A6EF4F5034D07F4C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700511019, "uuid": "b7d6a6a3-785d-4924-b517-83baf51b9fe4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700511019, "uuid": "1ce09dad-833d-4201-bab1-3314da962e26", "value": "6144:P7lIwowoAogIwowogoAIwow1QBIMAycdO7NbLX35FBpcP1axzzjUZwr6CrgdO4OU:jlIwowoAogIwowogoAIwowVhM7NfXJFe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700511019, "uuid": "e7755318-9e64-4a81-b9b6-d888c4a3ffd5", "value": 362864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700511019, "uuid": "2f751021-c157-4042-b08f-ca3477b6dd68", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700511019, "uuid": "0495b1b6-b9a0-4c06-82d7-32c8dbc969fd", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d472444d-87d0-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700504148, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700504148, "uuid": "402d2f12-9868-4c22-ad6a-032c47dcea9a", "comment": "Malware payload", "value": "e1170fe494e6a857b4423a366207b811", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700504148, "uuid": "63b2a180-2ca5-45fc-a15f-34d46a7d1a1b", "comment": "Malware payload", "value": "147030ad2b34a1be1d22bf564cae6d2a858c37d9237d97e28050bf32dc8c5a40", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700504148, "uuid": "9b99706f-4559-4265-8c25-8842c4631908", "comment": "Malware payload", "value": "41c205dee65f1e2171919a1e1811d63f28ca1fa7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700504148, "uuid": "bda73872-87e1-4c6e-9257-f0bbcb6a4eaa", "comment": "Malware payload", "value": "90ac1420750582be748c6d16df431f2d5f09d4cc6412c91f1aa6d5779628fde4712b3f0a270c5a68dc96ed024963b1a8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700504148, "uuid": "229c390c-4993-428e-a43a-674b5f53a704", "value": "T12BE4128A36450B22DDFD63B699225F240BB2563E796DD7E0EDD390CCA346F019910F27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700504148, "uuid": "2f1c65b8-61f9-4e5a-bf3b-693dcd12df9e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700504148, "uuid": "dcbaa230-4204-4b84-ac01-a00ccf06d810", "value": "12288:EeQXucvCeAeQseQKPJkSCzG8d7hq0vwS3RmF6qc96zXFSjwuaQzpccW0S2kZwh:Ee4ucqeAete9JkVzGC7hvvP3+6v9KXsM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700504148, "uuid": "041648f1-22fe-40e4-9312-2acb90dc520c", "value": 698368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700504148, "uuid": "f17a64bd-75cc-491e-9de3-1862a92b4bbe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700504148, "uuid": "b0793ef7-98d2-4d7f-95a4-e0c75e9f73e0", "value": "Payment Advice - Advice RefA1T9IvYc5tfi.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19658cd4-873f-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700441557, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700441557, "uuid": "584c93ee-1639-4d56-8d01-c81f24ad57b8", "comment": "Malware payload", "value": "379bd46d79cf086a4de78cf9ae985563", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700441557, "uuid": "22933e93-fbdb-4ff1-b4ce-c37065824685", "comment": "Malware payload", "value": "14cd46ca88878c0d352ec0108201877a99de66110cbfe00610b5a37984fdde25", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700441557, "uuid": "c6287f90-c5f2-42be-94f4-3be5e691736f", "comment": "Malware payload", "value": "d56b4dd153a4f1eee16f2b4236f4566e99da0e9a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700441557, "uuid": "c0cf156a-2d27-444c-b197-e02991ba0a4d", "comment": "Malware payload", "value": "c05cb93f3025f624231159b5d54bdc312c1c291e2272a746cbe93f4649253a8d8dcfd33cd5d1b6c3843255a1563347f3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700441557, "uuid": "1894a7f6-a26e-4f05-bdbc-66eec63a0abf", "value": "T1D4559E71B502D037E1A101F5A67D9BA612A9BA301BAB08D7B3C05E3D95F2DC36235F27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700441557, "uuid": "7590c37f-795a-4315-8261-bf6ea07afe7f", "value": "7482a1595744a3c77ac9461f3f27a729", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700441557, "uuid": "b34b5727-0ac3-4119-a44e-3d099715b2eb", "value": "24576:NmmEs2wqfcRBxJCBEmAMpCOJMbgp2kvB1Pj5R+d3ThJgrU35Zln2i6:8dw/IyPxbgp2iB1Pju3TIrK5Zln2i6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700441557, "uuid": "6d7ea44b-6202-4517-aad3-e17838b97dd7", "value": 1322323, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700441557, "uuid": "78297ea2-8d34-4b60-8d7c-f0a015c53ccb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700441557, "uuid": "f9ff9344-a494-426f-903c-0b3079e25bdc", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5a610c3-873c-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700440611, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700440611, "uuid": "3e616f0b-3bed-4f19-9875-8a27ba9e2076", "comment": "Malware payload", "value": "5f33c78627530390005560fcde1f4537", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700440611, "uuid": "60f40786-28b4-4b21-a07b-3b5b4f5bd87a", "comment": "Malware payload", "value": "1506f71dfc8812a79822c3327bb39dda2ace83c6f0570e9ea53be6bf106ac343", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700440611, "uuid": "4c1611f8-4c8c-4036-ba3c-106558b15a64", "comment": "Malware payload", "value": "40f160c289fe48c99f87efc24150267b69125a38", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700440611, "uuid": "9706a569-3701-4311-a537-4e501df420f9", "comment": "Malware payload", "value": "6237ec1ee82e8153ea9e6136f2d9e7db8266361c0a01fcf51ab1c6e2b35b44a2eda0e3517fd1b7f60e17477eff076adf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700440611, "uuid": "84bd1067-20b4-4bbf-b599-6f8cc1de3cf3", "value": "T18556334FFF45DD0CE73C683D80A68AF7C39D71B992F54A8B653CC21868D11628B29B94", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700440611, "uuid": "da4b9472-ed62-4023-80f7-c8b6c4f76c47", "value": "affa2f94d00b1c91617b7450de103626", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700440611, "uuid": "c97bc312-9197-4420-b71b-ba304cebeb12", "value": "98304:R7WLyKYactxOKcAxS1tF3+ipitzpIlCTh9beKupnjaO4kR4ll:g2KjdKM3+kDlqhYjaO4kRs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700440611, "uuid": "bd960b7c-1cd9-4ae0-8500-4e8bc6606ca6", "value": 6147677, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700440611, "uuid": "ba6725f5-7b63-4bea-a9a2-f6f38d8e0783", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700440611, "uuid": "5ee92b60-95c7-4e73-ad9b-5209ec18d944", "value": "SecuriteInfo.com.Win64.Trojan-gen.28766.9847", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5ec3736-87fa-11ee-8907-42010a9c0042", "comment": "Malware payload (NetSupport)", "timestamp": 1700522109, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700522109, "uuid": "ea66e763-e739-4102-b273-911a6e892279", "comment": "Malware payload (NetSupport)", "value": "9927a607a52567792a420f2ed4467837", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700522109, "uuid": "20cda214-a8a8-4861-9c9c-ef74aaa8a3a6", "comment": "Malware payload (NetSupport)", "value": "154c606a6781addd71b108cdc62cf45cd1786ba7e7277105d71acedd86d565a5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700522109, "uuid": "0b1bb61a-7f47-4e34-8706-55a1b6c5305a", "comment": "Malware payload (NetSupport)", "value": "7ddf28bd347d57ba3fb2a71a979df2f1370f6b2f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700522109, "uuid": "5ef25b2d-b886-4fc0-b680-97d2c3a1c78b", "comment": "Malware payload (NetSupport)", "value": "75221cf7831a4a21cf02b22a22ec6a9eec270323e95794f339ec973459a72564183a4dd29f2f496721e11b94b4aa1e41", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700522109, "uuid": "94394d9c-7f7b-4e87-a45a-ee89059a6fa5", "value": "T1FEA52261BBE0DDB1F12124337961A23C66FA7C10DEF484AFD38EA519A9721C062F1E57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700522109, "uuid": "47ae0402-8f8d-4127-91a2-c76f181e3d8d", "value": "aac51396886833dc961fcd7aab7711e4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700522109, "uuid": "05ba90fb-8b02-45a9-b6d5-b2d7ac21a40c", "value": "49152:3daBDJkP0SrSzXcW5FLEg95FnkLl6XVQsZL2UvMSvWLEU+thP4Gz2e:3wzksSrmXcA7p8l6GKDTSb+tJ5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700522109, "uuid": "63657736-3773-461e-bfba-ed3b8a6097e4", "value": 2154556, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700522109, "uuid": "89fd1b7b-c562-4243-9474-f913e6168bf5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700522109, "uuid": "35ae43db-1cc2-47a3-91a2-f9f149b088a7", "value": "646f739241e98f819327983bb8083baa.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83682da3-87bb-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700494992, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700494992, "uuid": "88ae6ae2-8cf7-4a2b-a22b-4dcf16136512", "comment": "Malware payload", "value": "ccf1978c3721760bd06614b3288977ed", "object_relation": "md5", "Tag": [ { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700494992, "uuid": "42bbac7d-8777-4809-91e0-3cc72e228b23", "comment": "Malware payload", "value": "154e9df5c85ddd030fc3c788380a991383bab9ea1e4a2f6041e9763b41c65a94", "object_relation": "sha256", "Tag": [ { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700494992, "uuid": "0599d0a1-1ef0-4991-8368-aeb8077aa1da", "comment": "Malware payload", "value": "304ae7525a26cfadc822bda603488d3caa15a76d", "object_relation": "sha1", "Tag": [ { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700494992, "uuid": "177e3bb0-81cd-4f34-b05e-ab32e023a54d", "comment": "Malware payload", "value": "fd488aa79546b57551fea977d359b37c4b362adb8484bba152d5893a8a710acb8cd56bc6c2394bb4e12a5d1e615115be", "object_relation": "sha3-384", "Tag": [ { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700494992, "uuid": "eece8a6f-cfd1-4e86-8a1e-5218fb0d401b", "value": "T111C4237F3CA3422CD3A673FD2E6650F6A798D4152D12F87DB0DE99C163E27A24183948", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700494992, "uuid": "1f5296ad-7298-4340-a768-562b15df5f02", "value": "12288:vYrQzfH2N73ZhUejP4wqvHTEFKXx+lk1hcU:ArQz/8ZhUejdqQFpkPcU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700494992, "uuid": "78a6626f-bd7c-46a5-9d8d-646b012753b1", "value": 575096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700494992, "uuid": "46a7d907-2f11-4777-b4ad-6caaa1101969", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700494992, "uuid": "1c54fb37-c61c-4b8d-9624-d845bcc41f53", "value": "RFQ_NOVQTRFA00541.z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1c1c10d-874c-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700447369, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700447369, "uuid": "90c55a2c-6f2e-4727-951b-c7f4cdda9f34", "comment": "Malware payload", "value": "6adf7f3969dd41b43154cd418f2a996a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700447369, "uuid": "77bb875c-9aaf-4b07-ae08-6a6cf44d01f0", "comment": "Malware payload", "value": "1609e17b2e0899c7dc0e8b544d4d5419c055cc0f3440237b27f0bb34e3776f83", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700447369, "uuid": "4682a406-862f-43e5-a385-2805e534f4b8", "comment": "Malware payload", "value": "4c9eb640366c935f3e3de69a9369f8a189040510", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700447369, "uuid": "0bb2215e-46f6-458b-a5d2-ee39fdf9592b", "comment": "Malware payload", "value": "76a99d2259974df44cc066055f5d8587f23f5bab97094035564bae7b5f28aefac6fe2f7dcbabae181bc1a35d35f17253", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700447369, "uuid": "28d72a03-8faf-4d46-9d16-ebc9193045b9", "value": "T1E3559E71B502D037E1A101F5A67D9BA612A9BA301BAB08D7B3C05E3D95F2DC36235F27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700447369, "uuid": "cf69b81e-ee37-4e1e-aab7-cd0342983905", "value": "7482a1595744a3c77ac9461f3f27a729", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700447369, "uuid": "63be10dd-7c9f-420f-b9f9-a98e1b3f3350", "value": "24576:NmmEs2wqfcRBxJCBEmAMpCOJMbgp2kvB1Pj5R+d3ThJgrU35Zln2i6:8dw/IyPxbgp2iB1Pju3TIrK5Zln2i6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700447369, "uuid": "40ddc354-67e6-41c6-b1d2-3636f7ec6472", "value": 1322338, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700447369, "uuid": "1beb5c9e-d069-45b5-aa7d-3ccba28e2f33", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700447369, "uuid": "5c65d4bf-b293-411e-a516-d548891a3ee6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7b26603-8775-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700465096, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700465096, "uuid": "a2f829eb-e75b-49fe-bab8-eab7322fc16f", "comment": "Malware payload", "value": "068e82eb495e4bcb72756a39d0e1c274", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700465096, "uuid": "d9c9cd91-0535-49f0-88b6-192aabd66ff2", "comment": "Malware payload", "value": "1628647c9d28f39641d4d0be0192d09e5881164ef199f309f49488b0398460f3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700465096, "uuid": "a230ddc1-9c44-4b52-95dd-c4aef83c28ae", "comment": "Malware payload", "value": "02ac87b8f6149c6a8464ecaf1142c8652b66e9de", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700465096, "uuid": "3082f42e-ffed-4bca-b0ae-1a297e832e06", "comment": "Malware payload", "value": "ce4a92d692f1212b176c1039cec929eef696c7da45d82fc19be30cd74bf19d65f930a4f688ca49a1aca34e2b2a8f09c3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700465096, "uuid": "49920fbd-c1b7-41f2-8872-155b83d2a1ce", "value": "T1DDC4014D0F49CD37D6AB0F3A80F527920339C969A75BEB0704886EF61E1B3D75A43626", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700465096, "uuid": "2e08bf1f-95a3-4195-9aa4-79b9ce7ea644", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700465096, "uuid": "9c229e9d-dfa0-4982-aadc-7369c713be49", "value": "12288:uJTvPPZV+ooQC3FFk0DhaKq7Sw6yQNIUfeCBAJXA:uJTvv+jFzDhmQNIUfeCBAJXA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700465096, "uuid": "36383735-bed7-474f-a5ce-73fcc43dce02", "value": 570368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700465096, "uuid": "18b5426d-3ea1-4c97-a451-bfc10c7d2921", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700465096, "uuid": "3857ee0f-fb9d-488b-a86f-5da3f912ac8a", "value": "Khbmgqxn.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "880a11e9-87b3-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1700491564, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700491564, "uuid": "a3fd7c09-4ac9-4a0a-990e-30662b135aa4", "comment": "Malware payload (AgentTesla)", "value": "490e409cae35fdecd479c74545c6c64c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700491564, "uuid": "73475215-13ad-4fb6-996c-82ea7a9599b7", "comment": "Malware payload (AgentTesla)", "value": "16a5368c8befb46e2e872d1fb695f1a9372b8e2db4c8549f14603745a61e034f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700491564, "uuid": "b6866e62-1964-4ee1-93c2-6b1fb7341f52", "comment": "Malware payload (AgentTesla)", "value": "539829dfcc3bff9d520be863cccf7106e57eb9bf", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700491564, "uuid": "809bc00b-ddf9-4ea1-8f16-bd92c826bdaf", "comment": "Malware payload (AgentTesla)", "value": "1a2eb122d31a6c93acb578fca716f45ba95ea8881fa03afb02de12039f94ced5c5ae5eea967367cc65f46ea901ef73a5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700491564, "uuid": "b4effe0d-e86f-4fa5-99ce-e2ae8dcea91a", "value": "T16A05D53D29B91267C0B9C3B78FC3E427F1789DA77015ADA4A8D323664392A5674C063E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700491564, "uuid": "4779d837-2b36-4f54-a06f-4b7ab41dcf8b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700491564, "uuid": "c2836810-ceaa-4dc1-a76c-467599a36dc4", "value": "12288:FRUTV5n4uxlxPJOAXrtiJwdt8rxCjkSeVHIzq8rFu+NBwBdlSdCMrAzXEu9:oTV5n9ns2ia78rxCjk/AqMVytMuE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700491564, "uuid": "9d921f8c-a56b-4c52-b334-97c4ff357307", "value": 857088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700491564, "uuid": "725f8f2c-0307-482c-b5a2-cb4f5cc1044e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700491564, "uuid": "1b4dda92-e17c-457f-b8d8-422b1f3020b4", "value": "rDHL46773480040.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76d16e33-876d-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1700461470, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700461470, "uuid": "2d1ec6a5-60e0-40a5-bbc9-39b0de05e4c5", "comment": "Malware payload (Mirai)", "value": "38b7497fdc68192cf387d0bf975b9330", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700461470, "uuid": "6a0c01a1-fffe-4477-b62f-11fbd69629ad", "comment": "Malware payload (Mirai)", "value": "1742a7073ca29bde8bfaffcef223143b9f3623aca76deefc7a9eaac1f86ecdb3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700461470, "uuid": "d496d186-0afc-4455-bdf5-abf0955a41ff", "comment": "Malware payload (Mirai)", "value": "66bf5e61cfdc5b13d2a111fed21ecc4eafbf1743", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700461470, "uuid": "91f4cf0c-5995-4396-ae34-ab991fef2f93", "comment": "Malware payload (Mirai)", "value": "8f97994ce7c4311c12688a041ab142284132d3c645633bfd7cf41aa42a565235fed07f1646585b65f15d0a090cedb58e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700461470, "uuid": "fb797d3a-ea6a-41e7-a8f2-c6e3ecb74332", "value": "T19D83642D7E21ABEEE5B882310BF66E70835922D632D19784F16CC30C9EB524C5C9F794", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700461470, "uuid": "85e5ccdd-466f-4add-a502-8a007f621e8c", "value": "1536:XrvwoIALlF757VbEaGLRFKHjPNs2lC9pbBPbz6OvO3/73XvujaD6C/FeG7f8/i8/:PFGs3XWjaD//7f8/j9p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700461470, "uuid": "21aad821-e92e-4117-8afa-02a6583bb7db", "value": 88396, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700461470, "uuid": "16c5c607-b372-4fda-a95e-7e0390f81958", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700461470, "uuid": "810da9fc-444f-4788-a545-e4a62cac1dec", "value": "38b7497fdc68192cf387d0bf975b9330", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70a5ba24-8752-11ee-8907-42010a9c0042", "comment": "Malware payload (IRATA)", "timestamp": 1700449864, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700449864, "uuid": "8a695cfe-d3bd-4541-b93f-8bd8b7a19c6d", "comment": "Malware payload (IRATA)", "value": "5060438df06671415a6f2e614405420b", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700449864, "uuid": "b74f64a6-feef-4734-80b5-fb24b60a37f9", "comment": "Malware payload (IRATA)", "value": "17d001badc91a8e6fa10766ed9e0d779c7acbb97f1b41582ab073e217e96cfbc", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700449864, "uuid": "bf20858d-0507-421d-86ab-4fe6028199f4", "comment": "Malware payload (IRATA)", "value": "31dce6d6e338188ce4ffd272adf94c0e84e996d8", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700449864, "uuid": "7201b772-ea34-4c05-8544-7a1969cd623f", "comment": "Malware payload (IRATA)", "value": "d1050bba4847ebbe487495b42523b9fce1515690c4c252ee048596e35a30da5739090f10bddaf80cb25601db62eb07be", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700449864, "uuid": "137e75cf-112d-4a19-8335-11d061ebb4f7", "value": "T14EE52303F37AA45BC47AD17725451A3E220A5D18CA43F64B2A143BFC68B7DE84B853E6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700449864, "uuid": "e64a7bbc-1da2-42f5-9db4-9eba486bc7c2", "value": "49152:nHKkk+XXKqkp6YttKXZwZSeKr4On3UY9fVHySD96EYBLG9wQiXCrDmts3nm4gZM+:qkk+XZkwhw6kOn3UcVP99CGCQTutq9gD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700449864, "uuid": "98519da7-a238-4774-99c7-ce7a1945a73c", "value": 3092867, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700449864, "uuid": "1c3a72b8-91d5-4f48-b735-2cd08189d7b9", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700449864, "uuid": "de3adeec-34c1-4813-bf79-25e95e8c42ed", "value": "app.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80f02ed9-879a-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700480815, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700480815, "uuid": "23e4d227-7731-45b8-9739-e233b8019a4b", "comment": "Malware payload", "value": "ceb1454815bfba05581442f0bfef24e7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700480815, "uuid": "7bf85b2c-4950-4e53-ad37-2148e42d7717", "comment": "Malware payload", "value": "19227c3cbaf6fe7441ed47f9e7a759d398ab55156af4cde8329d855e51ca79c9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700480815, "uuid": "51a28842-1216-40d5-a515-3ddcd7f7814c", "comment": "Malware payload", "value": "5b3688ebcf67ab8656034a3486b8e9526a2adecc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700480815, "uuid": "72bc8566-5dab-47d4-bab9-2eb363b15289", "comment": "Malware payload", "value": "733ad91479716a90d135bfb78e83453fa4c06eef554e1ac8eed9f3908e26309ed9f76ad6a5fc08d6c921662789c5188c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700480815, "uuid": "26bef414-191b-4e8b-9796-df5c81308ae9", "value": "T1C7442A37BFD88636D57E03B8A051413843F0DE0FB14FD79A1D85AAEA2D87742875A0A7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700480815, "uuid": "6f615a88-71ff-4e0d-b931-c162eed3f1db", "value": "6144:UbVhL5j0JYnuUGlELxj6nmQgXEoIuTUxeJhcFpQX:0VhL0mOELxj6/ZvxfY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700480815, "uuid": "d701d1a4-e0ab-4808-8bbe-e8c27623fd60", "value": 268800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700480815, "uuid": "9d90bfb4-a2ce-474e-a1a5-98c51f22f825", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700480815, "uuid": "1057baf9-8a65-413f-aa9e-e32e084fab22", "value": "QUOTATION REQUEST - VIETNAM DELIVERY.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ac0f5de-87b3-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700491569, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700491569, "uuid": "a0cfb081-99d9-4344-a309-8ea0295cd4b7", "comment": "Malware payload", "value": "d312ec6c46fb78e9d03079e6d940802d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700491569, "uuid": "21a756bc-8e04-4921-95b3-6c9dd476300d", "comment": "Malware payload", "value": "1a3f9ac2abe62763028d1975825e0058620a4c1cd4cdc6ab9ace7b34f5a1eacd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700491569, "uuid": "c414b03f-943e-4c8e-97b5-1907467fc506", "comment": "Malware payload", "value": "c944f9989bfd8210ebf4f7cd66f84b4995f26988", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700491569, "uuid": "d25c7c71-d1c1-42c3-861d-b2e4ebcd2037", "comment": "Malware payload", "value": "baae05c053aa29d73c42b03c4add86b0846c6449559044befd554b27c5c30a961adc3ec8eb383dabe73bd923a7b63704", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700491569, "uuid": "6c81f928-e748-48de-a5dc-48ee775b1f89", "value": "T113E423D43BA04563C3F659F384FA294806F7F59B5882C1DD4C8110EF8BEAF8989497A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700491569, "uuid": "6f1ae4c6-79bb-4c9e-b3bb-f97000d5fdbc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700491569, "uuid": "9f9172ee-e675-4f95-ba77-7f47704f89c0", "value": "12288:YR361h61EWGj5qzNlkOVqlKkasGarzFcPkn0ZuHy23XByrx0MleCIWIQQyM61:YMY7GjWNKOVi6xMB220sjHByOge5X89", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700491569, "uuid": "28bce2eb-9d79-4c9d-9262-f9a196a65e2a", "value": 659968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700491569, "uuid": "54d51100-5cdc-4275-b081-8305e13bda34", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700491569, "uuid": "60f4d2b3-848d-43dd-b566-bdcfd8500deb", "value": "rTTSwiftCopy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2a037e5-87db-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700508869, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700508869, "uuid": "465ff996-18a6-450f-98ae-b370c43af82f", "comment": "Malware payload", "value": "67c8bd0bf1a0c3a498a4f36265671401", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700508869, "uuid": "4df387a3-1ec5-4a5e-b922-01157fb762bb", "comment": "Malware payload", "value": "1bf63c1adb88498687aa8e1f11fc3c407428f53d01777a57af7f98c8df9321d4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700508869, "uuid": "abb1facc-ee01-49bd-ab46-055032d66df3", "comment": "Malware payload", "value": "8e472e84a5e3f072c927209318928839e4aba7e2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700508869, "uuid": "97318fb5-1bbe-47e1-8bbc-df429de3d442", "comment": "Malware payload", "value": "25833a36a132c2efbcb7bc8c3a2f5a4fb7179d87009f6a1f02eddc6f50ff993382bd97aef18ca80e6700ac17992c846d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700508869, "uuid": "6c4d99bb-2fc4-4f3a-abc4-3a734fafaa17", "value": "T18424BF2277E1C032F16755344AB2C6A25F37BC615B7296CF2B841A7E8E312C1DAB9316", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700508869, "uuid": "a6cee04d-5a65-4ad6-9796-c55e5b670d0f", "value": "238e0fa0f52afef2ef7eb9659d95319e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700508869, "uuid": "4883099c-c2e8-48ea-b83f-5235a827a6db", "value": "3072:ZqUbOkys7CwOk/H8v/cy72WzSPwM0qd/FVbvzxdk:9FySC/k/KkyiWWFd/Dt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700508869, "uuid": "11bf13c2-4f53-433b-8ef3-fceea4c4e998", "value": 213504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700508869, "uuid": "e61b4d9b-18c2-4bf4-9efb-264fbc8c5e25", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700508869, "uuid": "e22ea224-37d0-4639-a524-f9bb7a034098", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e17c5658-8749-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700446188, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700446188, "uuid": "17d0c15a-2492-4d98-8675-c6055b5c0186", "comment": "Malware payload", "value": "63832c24bb021b339a95af626a203137", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700446188, "uuid": "af16a99f-4e3f-4bb8-b5cd-a1c7d43dde4f", "comment": "Malware payload", "value": "1c464086f6e97b76aba19703fafb6b97adb3aaff5663ce8b766c6951f8cd0d55", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700446188, "uuid": "b51aa750-3f0a-4bab-add3-cdda6ffff41c", "comment": "Malware payload", "value": "992055d558d017c33048fe4d28a657ae150df746", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700446188, "uuid": "5c7ac267-e1ff-4b9f-9969-d2901c8da35b", "comment": "Malware payload", "value": "148f8754f25f6fd4cd8b469b796a4ad3b4d2b2d8543786d12e1de4d1d1057fb0199c0203b699479e8358893ef4899bdd", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700446188, "uuid": "c51b5ecd-5039-4244-a37c-fdfb233b3c65", "value": "T13056F1D9F7D9592FC87714B6CDAA92F112574C028A439F43A948331C78B76E80F89BD8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700446188, "uuid": "a5fc150d-b987-4a82-973a-2151e5cbfe69", "value": "196608:2UUmv4mSowLaJfGGKoTf/3r4mxvjVLkgK:RUqTeOTMmq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700446188, "uuid": "6731b7d8-c92d-4cbe-ad3f-03e200e2cd83", "value": 6428273, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700446188, "uuid": "285cec29-f05b-43c8-8da0-9abb6d5ff9af", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700446188, "uuid": "8747d86b-e9ac-4621-ae1d-b9c7e7dcadd1", "value": "app-regular-release.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bef80ee9-87fc-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1700523010, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700523010, "uuid": "8ddb22dc-61f7-4fb9-8e98-460a868589cc", "comment": "Malware payload (RedLineStealer)", "value": "d117bdd49deff0dc9c560ed4a03d3a5f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700523010, "uuid": "d27756b3-2afd-4b0e-a9de-4a62d15dffe7", "comment": "Malware payload (RedLineStealer)", "value": "1c64b3695016d0d7f981448fa92d4665e16306530c186343ecfabe8bce3f3d25", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700523010, "uuid": "d1c5ae61-239e-45c3-a9b8-449f78f9b1e0", "comment": "Malware payload (RedLineStealer)", "value": "4cb539531d38807e8480e8744009015552942749", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700523010, "uuid": "2def56c3-2316-4aaf-838c-a43eaed2c1b5", "comment": "Malware payload (RedLineStealer)", "value": "5990faa9526d2bcc171dbb7346005c3b1ed1f22ae7d587fb435af760345460533b7da4a678328c4a6cc2b1643606e8d0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700523010, "uuid": "2bc3b1de-1431-4533-bda1-49e93b58cc2f", "value": "T179452313BBD4C437D8B22BB048FA02971A733DA16631C3AF3785856A1D73784D97276A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700523010, "uuid": "d80f4280-652d-4b86-a95c-025405d92503", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700523010, "uuid": "2ac723a6-9490-4d95-8a77-ed36f4598e49", "value": "24576:vyLlqCoPuW8A3ZoR+gfudVPXjCIxDIKF24FQGknuzgm:6LlqJh8LE2MtE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700523010, "uuid": "c04ac189-e7da-4d76-b9c6-a4960902136d", "value": 1199104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700523010, "uuid": "b1fa55da-95e8-46e5-bbe2-f5bc9247e6c8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700523010, "uuid": "6ae1db58-66ce-424c-a928-be49a0b6ed02", "value": "d117bdd49deff0dc9c560ed4a03d3a5f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "519a3b91-87af-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700489755, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700489755, "uuid": "34c4c88f-7688-4671-9fc1-391734d163c2", "comment": "Malware payload", "value": "24f7db07213c00b85854d513b3a8061a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700489755, "uuid": "9bca5f8e-3d23-4ebc-9bb4-cab181d90802", "comment": "Malware payload", "value": "1c8ba53a0df3d48bd031a348f36b5d75ac78db8d94987a3368a9c49429b47222", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700489755, "uuid": "13ab0a27-ff8c-4f02-ba19-dad80bc96b32", "comment": "Malware payload", "value": "566085ff56c9c111a58e0f2a61fcdaaf49426143", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700489755, "uuid": "18283617-98c4-4d90-9422-60ad83fe48dc", "comment": "Malware payload", "value": "6a1af686bc0c2a26a25d224e4401246d212ffd8a9785732f367e6ae652b21a2884adbb0a5bd603e69bc903811ec2e8a4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700489755, "uuid": "1c6791f2-7242-4dc9-989e-ebcc53e6bde2", "value": "T16D345CB1EB69161E4D4B37EADC414C46C5BDC1294936016BFEED038EA10B89C93BEB1D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700489755, "uuid": "db264668-a25a-4aa7-8a36-8643ccf755de", "value": "6144:BBruKFNkrk8eN399bE58UDMrlxuXXhT2K:Brqo8eNIDuDu1N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700489755, "uuid": "9fba5df7-3891-48d4-822e-000076d385ab", "value": 247568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700489755, "uuid": "1ea5e6a0-47e5-4c88-a003-d309193dc7a2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700489755, "uuid": "9356e6c4-62fd-49c1-99b8-52b815d6ebfa", "value": "SWIFT.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92f8552c-8779-11ee-8907-42010a9c0042", "comment": "Malware payload (RemcosRAT)", "timestamp": 1700466672, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700466672, "uuid": "5dff6d3e-ee9e-4e3c-bb07-7ee98052800f", "comment": "Malware payload (RemcosRAT)", "value": "d6c1329fbb12e8c9c4b3f2cb3d85d74f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700466672, "uuid": "37e9e6b0-433b-43d7-b148-10220d664ec0", "comment": "Malware payload (RemcosRAT)", "value": "1c8d1bd43b0adaeed79d1e91fb3af5d840e9c43b15297dd347f61361ccafb012", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700466672, "uuid": "763b2928-6080-4959-b93b-1161519d87f0", "comment": "Malware payload (RemcosRAT)", "value": "ace83a713e24f7e226eafa097e38f3608eb1119c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700466672, "uuid": "e21c3f63-f901-4130-8b3f-9616a1930aac", "comment": "Malware payload (RemcosRAT)", "value": "78729b0cba58a479df8c9cfaac91bffd4aca7935e2ce898bd379358c18d7e7b3dd51abecfc66bc8c121c44e1f5a80e34", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700466672, "uuid": "e82cc197-403d-42c5-b7cb-b6161b77b53a", "value": "T1B984235F03D9C9F3D04E46311A697568C37EA222893B9E8BA3461F771D26AC39F47086", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700466672, "uuid": "9bf217dc-d3bd-4f75-883c-cbe980ea80f1", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700466672, "uuid": "a06fefde-bf07-495e-adc6-14f77f1b820c", "value": "12288:C/RmBrhEQbVeASKuUXibskHkVw/WQ+03bm:MRmPEyVOlRiwV+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700466672, "uuid": "d7678175-7833-4e98-abfc-37b2912aa1ed", "value": 404447, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700466672, "uuid": "14d602a4-c27d-48fe-8b92-ff280eb4a6fc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700466672, "uuid": "a2c0a0c0-af65-4bb4-9e21-33ec7613b94a", "value": "FAT0987660009800000.BAT", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84f14690-87c6-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700499719, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700499719, "uuid": "3277aad6-c4db-40d8-a468-829a72078074", "comment": "Malware payload", "value": "d66c44543879a1d56eac0ea9a975ca89", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700499719, "uuid": "1867b9f1-ac58-475a-a7f5-f6f2d652e409", "comment": "Malware payload", "value": "1cbdb7e611c27bd4344a10668b38005a97ac8033a2d0de66a679c3c0d1d1baa0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700499719, "uuid": "9c7b5aa7-e9de-4007-84f4-6283cf0b5018", "comment": "Malware payload", "value": "987dc6c4acd7211cfcfdcaac4cc7c7ab21223f91", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700499719, "uuid": "92c1adaa-1336-4267-87a6-afd40a206a2c", "comment": "Malware payload", "value": "1d7f0bfc4104f92f5ef5ac4a9e8fecabfae7c9ae67995f6fb8f54e8a0914578dd118eb7ba074da48e6c8c0f5ead6662f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700499719, "uuid": "b4cebed8-abe6-4e96-a79d-a8325562f534", "value": "T11F24BF2276E1C073F3674934AAB282655A377CE18771DADF2B841B7E0E212D1CB79316", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700499719, "uuid": "6d358f5c-faa9-494a-97e2-0379052363fd", "value": "238e0fa0f52afef2ef7eb9659d95319e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700499719, "uuid": "07294dca-a358-4386-b844-9ef23c2941cc", "value": "3072:tnj5zbZPPs7CwOAL1BKOU5j/C/SDs6AHZ9k6oKlkMJtR7jFZbvChdj:HxPSC/ABBKOSj/oSDs6AHZ9jZJjHU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700499719, "uuid": "fc9141b9-da78-4ef6-af4b-830924566a7a", "value": 211968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700499719, "uuid": "c19358d9-469b-49b8-b9b8-580ba6b36db7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700499719, "uuid": "42cc2ea0-1730-4613-8cbf-044d43cf748e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e02c7f1-87af-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700489722, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700489722, "uuid": "ee6bd38b-0411-4032-851f-aadf353f7ad6", "comment": "Malware payload", "value": "d508a3089156cdf09ac1d69c9db7346f", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700489722, "uuid": "c338ff9c-34da-4692-8de0-914a2733fd1b", "comment": "Malware payload", "value": "1d463fb77c68070dc97c346809710652ee66f2e5a41bd8b8742e9d6db28e1c93", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700489722, "uuid": "27fd281c-9fc3-41a8-8e59-cac9ded61bc8", "comment": "Malware payload", "value": "3ce338d3a3335e649b974bbc7058358be3a137eb", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700489722, "uuid": "e89d44c9-db08-45ca-b95a-604515d4c0a3", "comment": "Malware payload", "value": "f6ab1eed02783ad413763a462edee37b0975cb7392541799dc0e4cbc17fe74a1f7c6d9d9f99f7e81b66504ac84442eda", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700489722, "uuid": "ade128f9-86de-4922-abb9-1b3946c7e6f5", "value": "T1EED4CE3A6C3B9840FFFCC138BDD4779142643ABEADC95F86E844B5C976A32D49231462", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700489722, "uuid": "69929dba-7999-4aa3-9939-88687154f81f", "value": "6144:DO9LPrA8WW/HrQD131ikjd9jzbA52PbeVK0HrTXpwPiEME07lmwp3GtHeOLJn31z:qTbt/Hshl1jbK2ybJKiENUl1GlXNn7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700489722, "uuid": "bb6588a1-52ed-45b3-92de-96b28877b056", "value": 634256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700489722, "uuid": "db36b741-ad26-41a7-a7c5-c1c26c76a5ea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700489722, "uuid": "b94843b5-56d7-4973-973d-7516e449d0d9", "value": "PEDIDO_-CIF B-63326020..exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4185834d-8773-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1700463958, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700463958, "uuid": "28d64aa2-d590-4bfb-b886-4597b75f60ca", "comment": "Malware payload (AgentTesla)", "value": "cbdcf99f5255ed189e1135067b2e64e0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700463958, "uuid": "3d925e57-0ed0-4ab2-8e67-0f3acc6c7bfc", "comment": "Malware payload (AgentTesla)", "value": "1d7b401ea7bf4f36433e63335d35807a419d1c1fc2c3f1ef1702898713e11757", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700463958, "uuid": "2955ae5d-2db3-4173-98b6-7646cfdba4d6", "comment": "Malware payload (AgentTesla)", "value": "fb18f5f1a346db21f062d8b88893bc428fc472e7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700463958, "uuid": "e3d06fd0-8ec2-4c7e-8b4a-d59a918e3a7c", "comment": "Malware payload (AgentTesla)", "value": "3bba4610a1723c431c8f43489884f6a7d7fe4e213aa35a851f05f6f541b0a7716344681ddb447139874b31bf514c1c3f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700463958, "uuid": "2499edbb-4646-43dc-8d78-1ce7d8087794", "value": "T1CD35173C2B9A0667FC79C7E6EBD09127B661A6E7B119DD24C8C213C65B12B0274D423F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700463958, "uuid": "2ac6677d-64f1-4019-95e8-6854521b7c69", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700463958, "uuid": "2ca28a6e-6ec8-492f-9537-9124598c6233", "value": "24576:rclEznOqRtyOuiNRh5XYaNjetr6XgE+qlHb8f9K:UEznOaNRh5XYaNjet2XpFJ8fk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700463958, "uuid": "bd72eb6c-79da-4b09-bcdc-8d7165537e27", "value": 1131008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700463958, "uuid": "9043901d-708a-4bc5-96e5-1e88d1f2c028", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700463958, "uuid": "3b13cd9e-9a07-4dfe-b09f-36ac59b88fdf", "value": "R7275-12112023.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f24b9a0e-878e-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700475851, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700475851, "uuid": "41b0e83e-ef8f-47b5-9883-b116fb5d25b0", "comment": "Malware payload", "value": "8b6d852616baa8e2fac7b13989c02978", "object_relation": "md5", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700475851, "uuid": "1ea0fd3f-bf9c-4e8a-96cc-987064a0e1dd", "comment": "Malware payload", "value": "1de371cfc639d9269543a3572ad6a835a6241eb6c0cd70f050342e9b41740ea6", "object_relation": "sha256", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700475851, "uuid": "6bf28f7d-35c4-4492-bb51-fb4352979780", "comment": "Malware payload", "value": "5d8466ffe987e4277eebff31390f5ddd64f8203e", "object_relation": "sha1", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700475851, "uuid": "f4700196-a524-4657-b381-eefabb93c6db", "comment": "Malware payload", "value": "8df8869c1bf6e283a7427663fb6deb89ebd3de7f5dad8c284c6df214ba991c1fb770166a67d431e9b97a7a30c8fceb86", "object_relation": "sha3-384", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700475851, "uuid": "5bd1c5b1-68d2-406e-aa1f-0947e01e25f9", "value": "T14C65F19BDDC04E75CEA1457C519BE028D3F022A9873A5E231DAB70380B2DD15BFA5F68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700475851, "uuid": "217eee58-303c-4490-a27c-752eb6dc2f3c", "value": "24576:JOhslvjwcGGaYZdpPQwWAbMg2z0mCXpjfVbI/hBn2y7:JT5pPF92z0mCZrVkZcy7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700475851, "uuid": "3deb3dbf-21ae-4294-bb82-46d5fe964adc", "value": 1507328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700475851, "uuid": "78637948-a57b-4e18-8274-2ce8bbd13715", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700475851, "uuid": "6963e4d1-9b59-4d6a-866f-585b86662d03", "value": "RFx DUE 24-11-2023 FIRST SOURCE-SINGAPORE.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00164e7f-87b9-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700493913, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700493913, "uuid": "0c4908ed-95a1-489c-935d-72e34493a595", "comment": "Malware payload", "value": "25ff816b602466d3b852bdcc0777a270", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700493913, "uuid": "de68bd73-a028-4fe4-a94f-13164a3ccdd2", "comment": "Malware payload", "value": "1e81637cad93e8bc80b6428291763926fe38f305f947d487e794a02044750524", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700493913, "uuid": "fff0c62b-ad02-446d-a8f4-11b27d169616", "comment": "Malware payload", "value": "eca1a25677f7e9d0b6e8b9003b815ba47e6727b9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700493913, "uuid": "c87c9c96-5168-440f-9231-33488944db7d", "comment": "Malware payload", "value": "5b78f4d8f8f533bc34f892aded02d76babba6a627800e8fd50a98575b73a5c67076289499d08761a07f7c46904b7d328", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700493913, "uuid": "0c22eccf-beab-4a4d-8a9b-ede256e9152a", "value": "T13F559E71B502D037E1A101F5A67D9BA612A9BA301BAB08D7B3C05E3D95F2DC36235F27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700493913, "uuid": "fec6b6de-6a1e-4527-a840-32dcd3d4e551", "value": "7482a1595744a3c77ac9461f3f27a729", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700493913, "uuid": "f8e16843-e71d-4b11-8c90-d9293106ec78", "value": "24576:NmmEs2wqfcRBxJCBEmAMpCOJMbgp2kvB1Pj5R+d3ThJgrU35Zln2i6:8dw/IyPxbgp2iB1Pju3TIrK5Zln2i6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700493913, "uuid": "cf62cbc7-5722-4a56-8cd4-7a19d909c8f9", "value": 1322454, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700493913, "uuid": "c8b58e18-1cc3-4f22-9ecd-165fd9793735", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700493913, "uuid": "d3ec0af2-eb9c-4991-b4e1-440fe0e40f1c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b0f2c99-8783-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700470953, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700470953, "uuid": "d77e1d86-2423-4ffa-8fae-729951008a4a", "comment": "Malware payload", "value": "b33deba4aed98e836c610e93cebbb4bd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700470953, "uuid": "9a599b83-f5e6-4699-a548-a4d38481c88b", "comment": "Malware payload", "value": "20b4ef8e8decc7e48f1ce33615ea9280c20f6ff81efafa86cf5f9bd7de4ebcdd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700470953, "uuid": "4dc4d58e-1706-4ea9-805c-44af3c646bdd", "comment": "Malware payload", "value": "c4cdee3aebadc6b7492e3df5a8fba45474349cdd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700470953, "uuid": "30dce8bc-48f3-402f-ae7d-67aba5a97ec1", "comment": "Malware payload", "value": "ad2a5d5546f0e5d5d4a11d6be504b04bf1278015a2bc468bb7ef97e8397e1768205b5a0ae78d419e3a5d57d30c4bb777", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700470953, "uuid": "856bf1f8-c721-4386-9345-b48921db03ce", "value": "T1EB35F703BA978DF5D39B2737C6AB04047B78E8816223D71FFA8A235928837775E45613", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700470953, "uuid": "df6103f6-99f9-4be5-8b1a-3a9aba95a287", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700470953, "uuid": "9c3e3456-bd03-47d2-b532-8e6d6bae6b22", "value": "24576:X63IURxKjmT3V1fpJ6vrpnuiZicOL2ruqABfJXA:Kb6yfpJ6vr57ZiR2ruqABfJXA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700470953, "uuid": "0252c5d5-5f70-4006-a512-78d3566126b3", "value": 1106944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700470953, "uuid": "a037d339-dc85-4eee-bdeb-fe633ad2e961", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700470953, "uuid": "dd0db654-426a-4c11-b765-b57f2099dbdd", "value": "Qppge.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "836c765b-877f-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700469223, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700469223, "uuid": "a2936bb5-adf9-4916-b98e-9549714b6f45", "comment": "Malware payload", "value": "d97076a4357bafd889a6bbe69784babd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700469223, "uuid": "802da702-8579-4ec9-8345-4735d3e0e0d2", "comment": "Malware payload", "value": "2142bf9679769f612e237f12f729a41920b4da72c2e23efe85e87cb3eafbf99d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700469223, "uuid": "6a521e40-298c-4d72-a3f3-c951b2fcd884", "comment": "Malware payload", "value": "9750a2141dd2b3a3fd77d6a7b3dd4ada07ab75e7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700469223, "uuid": "fb733a3c-134f-48f6-babe-6e2d95aac8b0", "comment": "Malware payload", "value": "ff0e09f4163aa345a4e3acdc76821e032b0f2b7bad1062dfccd3ec9a88e541bbec9e137587f6651a7737bb88eb9162b3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700469223, "uuid": "6ce54726-07e2-406a-916b-b9bd74e255cd", "value": "T1AFB58D03B6A7CBA2C16D5737E697481C87F1F9816B23EB4B798A236918C33B65F01507", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700469223, "uuid": "08bad4d6-90a8-467c-b24f-3e7853a49408", "value": "49152:yx1g0XPiN60VYuUFrztmC0kltbXGLD6sAYrGGu:iPi2mC9j+uGu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700469223, "uuid": "ac5e5bc4-ba69-4ccf-9961-bc7cee266d06", "value": 2351616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700469223, "uuid": "afe2c3ee-252b-4771-b0f7-07f56e1342ba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700469223, "uuid": "cd8782c0-f7c9-467c-aacc-66e087b0fd16", "value": "SWIFT DETAILS - 37AH47AH 4901L 3S71 01SBS40 3HS713 8690SKS UD8208S.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7892ae6c-8760-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1700455890, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700455890, "uuid": "a334665b-a3da-4fd9-be9e-86b4c8a97ff9", "comment": "Malware payload (Mirai)", "value": "1feb6a7a670efddbb2f82507681b8a64", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700455890, "uuid": "a77d7696-57f1-4289-ba52-8b9f294f30ea", "comment": "Malware payload (Mirai)", "value": "21d4e24504dab4898fd7ddc5d7a526a66a7121e95fc634e13e506752095251a0", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700455890, "uuid": "1b7997ef-a5bc-417b-837e-9f18ca0fe451", "comment": "Malware payload (Mirai)", "value": "feb72b265fd1a3b05a9e8ec11031847036935c1b", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700455890, "uuid": "c2945f70-1785-4474-a3a2-a05c4e511ebc", "comment": "Malware payload (Mirai)", "value": "f411420369319f42ca1afbd9ca610eeb278d6ccc5760ae36914328b1e54f84807df2f4b05a5baf550e19fcc7a2ad0134", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700455890, "uuid": "7047e0f9-acb2-4c56-bfc3-0ca35c22adc8", "value": "T179042A46EA404B13C0D627B9FADF42453333AB9497EB73069528ABF43F8679E4F22505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700455890, "uuid": "2420f8c8-6111-42cc-bf36-1f2030741584", "value": "3072:Uojk3NbBLbcBCkoajwdyqkkovT/6EBpWK/1Jso0M/Rq1q:5j4BLbEloajwdybkQRBQK/jx0M/RqQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700455890, "uuid": "f94c09c8-83db-4066-8afb-aaef060f08a7", "value": 179821, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700455890, "uuid": "33707236-1c23-4ed0-aaea-6285c20dee22", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700455890, "uuid": "6360d1ab-be18-4d22-a5f7-ce2e5f118e86", "value": "top1hbt.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e494b700-873c-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1700440609, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700440609, "uuid": "b111e579-9548-4fc6-ac6d-b10ddff9499f", "comment": "Malware payload (Mirai)", "value": "0b5a6aa076ed1320e7fea4c81a8cdfeb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700440609, "uuid": "af35025f-e81e-4d8a-b8b1-eb6b856ac970", "comment": "Malware payload (Mirai)", "value": "21eae63dda9ac84b4bd4284bfdbbc656c67cc88f41b519bdb2adc8e8ee8a8249", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700440609, "uuid": "0dffdb6a-f05d-48f8-b56e-135cd45ec1bc", "comment": "Malware payload (Mirai)", "value": "af74aaedf0709a9ce995c2b5f21262f000ce00ed", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700440609, "uuid": "c2ca3531-2651-4f40-af06-7e0ee07cc7a6", "comment": "Malware payload (Mirai)", "value": "69356c05f282b83e650ef7faf08c05f043488be5cbebf66cdb8850d2198b8ce1a6529f0c169001b6ddc7221af767b3cc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700440609, "uuid": "5ee39824-3052-44d6-a0bf-005baa4de918", "value": "T1C433E114EB1359395AFB033714A60CEDA6043058606BD26EBB434B6A7D1EFE52F0F6E1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700440609, "uuid": "d7305527-e1a8-43c7-9d4f-5935d4541272", "value": "1536:gVf5sThIkJXH7IpPhWYrR6pOSRfX7881hbWE98:nhLBMHWYAplw8CEC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700440609, "uuid": "556ea71e-432b-4f81-820d-043d4c972aea", "value": 52756, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700440609, "uuid": "f2da23a8-3abf-42df-ab16-3e1cd44dc6f1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700440609, "uuid": "23ce9796-dce0-4cbc-823f-a0a784beea57", "value": "SecuriteInfo.com.Linux.Siggen.9999.20344.26449", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "671ec980-87b3-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700491509, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700491509, "uuid": "a9bcd410-8f13-4f2d-be8a-340b41403486", "comment": "Malware payload", "value": "1c953cc64760fd9eb139d4459863c9b2", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700491509, "uuid": "adc97492-dba4-4cdd-bb59-0a68e80d2b59", "comment": "Malware payload", "value": "229f16dd479644837726445dea559bf09b17697280bbb99afb9b7459afa936e7", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700491509, "uuid": "520f6a3b-8ff8-4156-983d-c4be0fbca97b", "comment": "Malware payload", "value": "5ed350c9e5c7421de582364e2845051d97e30a5f", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700491509, "uuid": "507159f1-5b68-4901-a976-473434c5fcf8", "comment": "Malware payload", "value": "573141d1de202d5ace3c98b903a484ce97eb51ba9e13faa2e7fbe18aa81224c8592363c5406c05ed98399f4ada8e80b1", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700491509, "uuid": "061d5aa3-34ac-4961-a1cd-5f45bfe8eac8", "value": "T1C5A5330C4936C062FA89B1EA874B6562E22535898B37DDF7E320753095CFB26DB41CF9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700491509, "uuid": "caa6011a-ab65-4ce7-a017-d97833b228f7", "value": "49152:NCpstgRS52UDWpxYQCNxnQe9uYmqBwVDsmWQFH3v:N4sOkNifPCNxQPYrVmWQJf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700491509, "uuid": "759de94b-337c-41eb-aba4-3a59f1b5e8f7", "value": 2136845, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700491509, "uuid": "2fe61a2a-8e75-4977-af1b-1522481b120a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700491509, "uuid": "f1f76bb2-28f2-4a8b-9cf3-74c6ac9c5e9b", "value": "entrate.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01851a37-87a5-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700485325, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700485325, "uuid": "08b19bde-f21e-469b-bef9-bcd1e8c8681b", "comment": "Malware payload", "value": "ddc85ed323ac6649d7c37aed4820c092", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700485325, "uuid": "5a37414c-c535-4ad2-8036-3d4bf3dcbbb4", "comment": "Malware payload", "value": "22fcf360cea1149c89404bc89a2035e984b72c670d0051c50facf8e09e5133d2", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700485325, "uuid": "6349cfbe-f65a-4c1a-a2ae-4926b0db3515", "comment": "Malware payload", "value": "bca10ed3b5186ae3a3aedf83e63fe8f0e66144dd", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700485325, "uuid": "8e78c963-9fdf-4715-be90-95c32380151b", "comment": "Malware payload", "value": "ded5f754bdab065973e4cb01ff0653caedd85965e0f5d807ab8e08b4dd8e5f3188455ae071106fb16ba7f168538a5146", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700485325, "uuid": "de6f0b6d-8792-4ca9-8ebd-630d47114ae6", "value": "T11A56CF20BAA1C236D8B715B94DBEA39A557EBF702F2451CB72C40EDE0E315D5AE30217", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700485325, "uuid": "346aedbd-fce1-48d6-b704-6fd52af78748", "value": "49152:V8JYy3j5T+w+X7gJhHcnsZ9UwgV+UjgaebGz:KJYwTf67gHlUBV65b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700485325, "uuid": "75d01ef4-64ae-47bf-bde3-2d19cb7f432d", "value": 6291968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700485325, "uuid": "44d0825a-f747-445c-8841-08133528f6af", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700485325, "uuid": "4fd14583-0180-4fd3-8035-0f4ac4853928", "value": "entrate.vhd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37178b22-8769-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700459646, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700459646, "uuid": "45ae662c-531a-4087-9f6a-bf32a4de1960", "comment": "Malware payload", "value": "28c490a1fd4e120730112e82c9e38462", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700459646, "uuid": "e7b78c01-8bf1-453d-b8ad-75e9505ebc10", "comment": "Malware payload", "value": "232217425086463586fa617f55e66928e1bfc536e3d4b520c60bc79b4226248d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700459646, "uuid": "f29fbdf8-111f-4ed9-b98b-be2c6842918b", "comment": "Malware payload", "value": "092fccddcc69c4f11ec7ad560bd4350f5fb207d8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700459646, "uuid": "bd26592e-a50f-4de6-b355-47987f913700", "comment": "Malware payload", "value": "522adb48359849d48d0db392af674dabd40c3c9e1ca0b6b6b7c5ac7044a59815733d5996a73e5f37322d6118d3aa8f1d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700459646, "uuid": "862590e8-f08d-4678-80e8-c75a09166fa4", "value": "T1EBE7331DFE018E23E8D1A5773CAC43E2E9F0C240A360DE2B9B91D7987F1965516D239E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700459646, "uuid": "de375740-ff73-4a17-b4d2-c486152fe59b", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700459646, "uuid": "5f2b6404-486e-4878-a7db-e57dedf00f9a", "value": "1572864:2m6yTgMBGCZNbvZrfFYC7jVdleLWiHx6w2W7N7fdJ:d6yTgTCbBFYWRH8WiHX3RJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700459646, "uuid": "b207ccdc-0a5a-4a84-963a-d3a867ec218a", "value": 65441869, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700459646, "uuid": "1e8880a5-6c01-46e7-8d4e-df39bd71a07e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700459646, "uuid": "0aba0bf3-6e73-4da8-833f-7d522184e301", "value": "Charow.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76b485a0-8781-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700470060, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700470060, "uuid": "80a1fef1-e179-4726-8a8b-6d0a64fc3370", "comment": "Malware payload", "value": "f1a93c6f02b9cdb31b4bdebaca05f9cd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700470060, "uuid": "9944824c-b20d-4e03-a7c5-9a7cfb2d6bff", "comment": "Malware payload", "value": "255450b9a764515da75f17aeca45adb7194f3da05b55fe016008db2acdd40aa0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700470060, "uuid": "4c900919-c66f-4e06-b2ba-090386140382", "comment": "Malware payload", "value": "136b001856b58c461be4434ebd250e677852f28a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700470060, "uuid": "0a26327f-ad73-48d6-9945-e640040d195a", "comment": "Malware payload", "value": "eb351b98245889ad9a936c7cff5995ee8f9d86b59c93440d7df5a6ee29efece4621cd1a223c75346d682ea28860efe7f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700470060, "uuid": "373ff4c6-5e2c-4d3e-90be-bbf58065992a", "value": "T15CC31A9AA3F68B27CFFF2679E8B011120F31E6C56022F79B5A9845E209123555F3436F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700470060, "uuid": "7d09531f-fe7a-4d9a-9c31-0dd4f79ff5a9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700470060, "uuid": "789ea3f6-b91e-4a0c-9638-2016403e203a", "value": "1536:AeaNpmg/2z2oLylqMk7JFvVkifWNHepSdKkTrLpCS7VdPP1hmtESB8/WHOSTkiAW:JWpY6oDXvaif41dR/XMOPEU7q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700470060, "uuid": "dd498ca9-0fe0-4aa8-9296-f82248795fa0", "value": 124928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700470060, "uuid": "a66ef9dd-98fb-4b19-8873-c3fdc55e6811", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700470060, "uuid": "35a75b69-2421-41b0-a4b3-3f8385201b82", "value": "Aviso de disponibilidad de Factura Electr\u00f3nica Iberdrola.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d40c682-87dd-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700509558, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700509558, "uuid": "c1f67cd3-247f-4bd1-87ee-28356d6bef7c", "comment": "Malware payload", "value": "1063b50e4283dd4a74e80ef4e9ab1e93", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700509558, "uuid": "dd97a6c5-479d-4e03-a464-956bd3aaa938", "comment": "Malware payload", "value": "259f8a663b9300a6a9422da2ba09cc5ec58455db0edf216dcc7c25d5dfe1215c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700509558, "uuid": "8390c1e2-8b66-4adc-b80b-9a836071b52c", "comment": "Malware payload", "value": "40bf547f2a7dcc107c02fbf15cc6f717d8042200", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700509558, "uuid": "d895b490-3a3f-4f34-8a88-4f7e113776d5", "comment": "Malware payload", "value": "4280b1c654aed0214fdfc5ef4819be309ce66bc5cb53305f86e94e4f691196140c1f99d146a8888dc73c1ddb4c6a86aa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700509558, "uuid": "4652cb78-61d7-4465-98e8-23f5ad564053", "value": "T1D024CF21B7E1C076F22749344AB2C6765B377CA18B7599CF3B941A7A0E312D2CB79306", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700509558, "uuid": "788f513d-56d2-48aa-9a80-17702bfdbed3", "value": "238e0fa0f52afef2ef7eb9659d95319e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700509558, "uuid": "a0ab45ef-69a1-4bcf-8647-5b6a190febb7", "value": "3072:eZzbmIis7CwOgdSoOxrlDPlwVzoIkINXwcz5w9F12bvmdk:qViSC/gdcwVHJoim", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700509558, "uuid": "eb747d7b-1568-4883-bbac-036268071dd4", "value": 211968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700509558, "uuid": "1a009740-a943-4060-badb-f177ec20033d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700509558, "uuid": "a063cad5-4fe5-4115-94c1-e0c976b4a5f0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d677c3c5-8776-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700465496, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700465496, "uuid": "b0c49b02-0a79-4aeb-9302-ff34364be3b1", "comment": "Malware payload", "value": "beeb96513b1a4cb691cd74a5487411cd", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700465496, "uuid": "9d9cee4e-9d5a-4b69-8bde-034bc7006f9f", "comment": "Malware payload", "value": "2631fcd957fa92a639b4368cbfafda7719f32e1db9707441e4a312e6553f83e1", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700465496, "uuid": "213ff270-cdb0-4fa6-9c5c-1b3d3604770f", "comment": "Malware payload", "value": "3c8bf6d7d0a937159a8cb0b9c93fb98cf46cdc14", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700465496, "uuid": "2e04d2b2-802a-4fd1-bbff-e60b8efe12b2", "comment": "Malware payload", "value": "cf8b3c79b6940cd52f69e70a7c66d441ddf4627cc5c75ace4f7833ee31ca0d1c5468dba52b0f5331e7ae98e869104e9d", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700465496, "uuid": "a29a430a-70f9-4288-a29b-6b2a2acc66e2", "value": "T165442860CAD2163D4E0707EEBF018451C4FD852D832681ADEA9D177E62239ACCB7FB59", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700465496, "uuid": "d7c0fda5-2b92-4991-9d40-3db31ce3bbda", "value": "6144:jbhIJnEsmvnUzdiPPXE6kRSemB0q/CfOmwVeUWmR:fhRnUQPXpkwOwVpR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700465496, "uuid": "b9612cfc-ca61-4115-ba31-46bd8a0005a1", "value": 262149, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700465496, "uuid": "ed7df5bd-9595-4112-b824-f507f642be5e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700465496, "uuid": "57c7d7aa-fdd7-4779-adbd-5e71bc173c74", "value": "Solicitud de Cotizaci\u00f3n Urgente(202311_13432USAC_GT)\u00b7pdf.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5b9a0e2-87b3-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700491614, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700491614, "uuid": "cae18101-91cd-49c4-a5c3-9dc67bab052b", "comment": "Malware payload", "value": "f8d31f3b7fb53ef35edcc483360c5d89", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700491614, "uuid": "9da38784-3a51-43d5-a4e4-3074c0e0b5e3", "comment": "Malware payload", "value": "28a3132ff1dae5dda972e6d3910639c81d51bd593f065998df1e8efac0b64a9e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700491614, "uuid": "4049f653-6316-43ae-bef5-bb13265edc78", "comment": "Malware payload", "value": "95581d3aa3f61aee4f929e5e00ee3938426f8d5d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700491614, "uuid": "c9df579e-5216-474b-b50b-c69180daab01", "comment": "Malware payload", "value": "5c3db678303ee67455f4c83082b7cb2ab3b7f4eeb05e440b17c5ecfeaff35b8903bc0c2a422ecf16c288d59ff07b08c2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700491614, "uuid": "177695aa-0c37-48c6-bb91-82f237c0986d", "value": "T1A214BF2237E1C07AF16745344AA2C2A15A377C629B718ACF3BC01BBE4E316D19B79747", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700491614, "uuid": "223955da-79a8-47b5-a8db-d60558c1bd97", "value": "b759efdfaa2b106a9868739336fc4103", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700491614, "uuid": "b0342c99-4916-4635-b794-2ed4ce0020cb", "value": "3072:nCgVq+uwJmgOGnWE+GR81XYfKa2qbfyArQsAZCoXlv:FvugmPG6I8NY7nbfM9n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700491614, "uuid": "482d53a4-af08-4f4c-94fe-583c08f36b30", "value": 204800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700491614, "uuid": "1e72a88c-2e58-46c3-9d69-0adfa6a10e44", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700491614, "uuid": "60b61b26-ee69-4dbb-a1c1-3ed212a3b0d0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d5b03d1-877f-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1700469266, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700469266, "uuid": "3fd718aa-bda9-4762-aba9-33675d5c25fe", "comment": "Malware payload (Formbook)", "value": "dd87bbac4fd8e3a790307f7de2499fcd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700469266, "uuid": "8c34ac1b-c4cc-4138-b4df-6def7d024095", "comment": "Malware payload (Formbook)", "value": "29453e0659ebdf718d47133d7076acdf87efb097597463451ea119f1b4389ba4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700469266, "uuid": "6f3d6dad-f783-4831-b9ac-11d50a91958b", "comment": "Malware payload (Formbook)", "value": "53385ed5f89c316c31960696f8abd2fc5e9d9be4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700469266, "uuid": "f0bf7721-75de-45f0-85c9-923042168c67", "comment": "Malware payload (Formbook)", "value": "4979fdfffdb0990fd56e51ce8c3c496328e55ba3a58e7838af9b75be208e4c05897ebc0784971e0748f954d91d43b5b2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700469266, "uuid": "ec402da3-a69f-481d-a308-519dbbe8f98e", "value": "T1CB05F2CAB3205872ED2E12B4643ACDB207779C1A7454E6981CD77D7B3E7239261239CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700469266, "uuid": "9286fc49-e35e-4fab-9fb0-f4ac79a2b1fe", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700469266, "uuid": "170ae52f-b422-452b-bbc2-886cd0ed5946", "value": "12288:SJX4QtLaBlPa4T8UWXG+K9RBp6Z7ycesBzC3P/1MZeJoj203l3EycIyPnYX0XeHT:lkrwX6Z7ycp6n1nq53lNcVPYVH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700469266, "uuid": "e63482ad-37e7-4a79-93be-3f857a639eec", "value": 798720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700469266, "uuid": "19219b25-90fd-475a-8c8b-81b794799a81", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700469266, "uuid": "f50809c9-0132-4bda-8176-8f0df843cb19", "value": "Advice & Value Date_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c06a508-87b3-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700491544, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700491544, "uuid": "c84c9981-8043-4c39-91b5-929db197d952", "comment": "Malware payload", "value": "8d0cd971e44eff5c6a99232924b2f9a9", "object_relation": "md5", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700491544, "uuid": "c6429665-34e3-489c-abef-cbef2619fa8b", "comment": "Malware payload", "value": "2ae7221026597fdea305cc525caac710023e54ba48dad234f4e5e1196d9b3afd", "object_relation": "sha256", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700491544, "uuid": "945c303a-e4bc-4b0c-bad4-ec80e3c5c502", "comment": "Malware payload", "value": "a3c0d50d743a0b6aeff4db45e8ca2c1c708156d5", "object_relation": "sha1", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700491544, "uuid": "9bc3f99b-a408-4fba-a83c-f91d93eb6a84", "comment": "Malware payload", "value": "467e9b97ca609b2c16104b91bd24228b0f1eeece411bea8d72fa0e40e7be08c198f5bb9692455e02b3c4dc23367837ec", "object_relation": "sha3-384", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700491544, "uuid": "22b14a09-8e63-426c-b56b-b0806e6bb683", "value": "T18F45330D3E9E4013C1A9E69C9750798B9CB8B84B787D77367C41E3B662E376CC82D492", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700491544, "uuid": "17bc9089-ae67-4c9e-a7aa-cbe36e5d199d", "value": "24576:2RaJwTejOSPFCLaJ8CYfiGWrVquts1LKKbw9pTDoI2y2:2YCTkPERKGGVls1+K8rYI2y2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700491544, "uuid": "a6ea114e-57bb-48d7-bedf-d75b886199d3", "value": 1183140, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700491544, "uuid": "285de42e-6aa7-4c8a-a9e3-452737e061f4", "value": "application/vnd.ms-cab-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700491544, "uuid": "dd6c6757-0c09-4f82-8981-b7b31216f44f", "value": "nTTR_EUR_46_800_PDF_.cab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6c62d77-87c2-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700498139, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700498139, "uuid": "d1a17d8a-d3e7-4f01-bfab-30cc8a826001", "comment": "Malware payload", "value": "7fbc7b6e210ecd7f8f3d75b29fbda718", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700498139, "uuid": "0ca6e8a5-ff22-4e3c-ac6e-eeeef1cccd20", "comment": "Malware payload", "value": "2ba17d76139e825d72b295cb5c59fad65838814e8ab52c63fcaa2fdbc85f22e6", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700498139, "uuid": "76fe473e-dfd0-4ef8-989f-58bc0751a38f", "comment": "Malware payload", "value": "28ca8df26132f07c999ada3acbdfc33d4c520614", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700498139, "uuid": "b51eb109-963f-4e29-b4f3-98fecb8afae6", "comment": "Malware payload", "value": "c08364b191154aa0068f10b13144f2ff744dc67d41678c42c4055ba8699b17a4d844e496e257f006dd2e30b48f2fbefa", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700498139, "uuid": "17d179f3-44f2-4682-8cb2-f3cae274ea91", "value": "T16F75336DFED820ABB32E0E39829BFEB94543F1DF6615F8446AF6941C30101919D32F66", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700498139, "uuid": "936f1749-3a3f-4aac-bd27-c98c0886e8f0", "value": "24576:tmM9yVN3IgV8/kr767X2bxX7+JLISgT1w0n3tnpwAVn07ZR/2IKJScSvd:MM9krwk/67X0SNa1wy3JVK775KJkl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700498139, "uuid": "d1d1bdf7-0fc9-4cf6-8f47-d92a92ab4964", "value": 1562324, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700498139, "uuid": "1d765a4c-80c2-4e26-bba2-567f919890c9", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700498139, "uuid": "9eb596e1-b9b2-46ab-a011-e644d2aa71be", "value": "NEWREST Procurement.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "289fac8a-8777-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1700465634, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700465634, "uuid": "64176f02-9bdb-462b-9855-a498a6620b6b", "comment": "Malware payload (Formbook)", "value": "55d8677644f510f37ab097baf4892c08", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700465634, "uuid": "2f9b4c2c-fd73-4060-adc3-2243a4c179f5", "comment": "Malware payload (Formbook)", "value": "2ba7aff60ad42d9b35d87a2cd967c59cbee18341165fc33e5083788152b0d1bf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700465634, "uuid": "5f76d3bd-4366-4bc2-a601-5d07ed0a645d", "comment": "Malware payload (Formbook)", "value": "eb53fb9badf5d643b6a3ad8ba4ec6cdca014b25b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700465634, "uuid": "4e0af200-fb3c-4a47-9b71-ca6e9996f47a", "comment": "Malware payload (Formbook)", "value": "8b860aa659514bc2d490d16deca461d673af07bece875b49de30e48059d1fb068612fcbeb6cbc310437cddf5b5724659", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700465634, "uuid": "45794aa4-1d36-4403-be08-a11d634b2f66", "value": "T185D423093669AF27C5BB67FE5974515107B282A77072E68C4CE07AC31B73B802D23E5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700465634, "uuid": "ed703360-8a2f-450e-a237-60940bf3b319", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700465634, "uuid": "57737364-347b-423d-94c5-ace9650a7929", "value": "12288:AVMcthmJ+LckWTLv/rXYwbx7qUt1601dHuQpFeswHT1ltm/KpakWiL7AFnS:HTfLRbx7qmAadzeswHTztm/KHNHqS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700465634, "uuid": "c0aaea9f-ec43-4b63-8c84-cccd4b70403d", "value": 644608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700465634, "uuid": "1a22e24f-7796-4b8c-9516-d62c311992d9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700465634, "uuid": "d8561ac2-2576-4ec5-93f1-ec455c52a701", "value": "DHL consignment number 8807995460.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab4fadcc-87b4-11ee-8907-42010a9c0042", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1700492053, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700492053, "uuid": "b4d54f65-6108-4306-917d-f78ec01f6e3c", "comment": "Malware payload (SnakeKeylogger)", "value": "c6e93bb1fe3776c6fab7c4dbf5ad9aa7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700492053, "uuid": "b2fd47a8-184c-4d8b-b559-657aae2e3152", "comment": "Malware payload (SnakeKeylogger)", "value": "2c5edc6480fe0c2912dd55fcd4d63c494e425c7466ce5655e1ebc076a0d8d389", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700492053, "uuid": "9bdbba94-9bcb-4115-bca2-ddc610a58a84", "comment": "Malware payload (SnakeKeylogger)", "value": "9c8101b401864743b197029a2ceb97dcb4dc8a27", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700492053, "uuid": "1a636332-7070-4746-9a9f-1d52131cbeec", "comment": "Malware payload (SnakeKeylogger)", "value": "782db0becdf25f4f4974eaa9512e9912893c29ede41727fec3e0be6c8d9b6ec19add910d1a04df52749b040e3d18b75c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700492053, "uuid": "e9b07c24-d639-4c8c-aebd-440be7230e8f", "value": "T13374021A13D816B0D36A87BFEDA604000776DD296403FB3F9E8180BB0FD7F956651AB6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700492053, "uuid": "2e367d58-363c-4cf5-a900-0a22e8ea81b3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700492053, "uuid": "6bdff8d6-cc0f-4378-875c-8a02df1fad58", "value": "6144:KGml3pBvuZ3UAwhUWsnC93yYkBxG8Vm5Lmv/tXGAunkc8sUnerSXE:KGml5B2BUJACxyvBxnHv/t2Ask3ng", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700492053, "uuid": "7e0f670f-e130-4a12-ad47-306654e04e27", "value": 364544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700492053, "uuid": "4ee59566-dd3d-4ae3-b123-fdc9bf583ccb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700492053, "uuid": "d0016fb9-7581-416e-8f46-1bb5695e9255", "value": "cargo details.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "829b17c5-87b3-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1700491555, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700491555, "uuid": "fb8de3f4-fa04-49e1-ab40-94e598cae3b1", "comment": "Malware payload (AgentTesla)", "value": "4ae123b8dd8f2108225f3731453117cd", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700491555, "uuid": "2e1de3c1-9c32-4272-b75a-1e30380b2ba4", "comment": "Malware payload (AgentTesla)", "value": "2d2ec5676bd28d3f00ee24b10116feb9540e6bd015b86c8579a716a1237096c8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700491555, "uuid": "263bf8d8-92fe-42f4-9966-19849ccd47ae", "comment": "Malware payload (AgentTesla)", "value": "1fcc29ee7df95e89489baf06e86ec0cc39ee2b4f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700491555, "uuid": "2931a45f-12d9-4612-b3d6-e87fee1cad02", "comment": "Malware payload (AgentTesla)", "value": "3c33be4aa1845634430b0568acf5f10c899704228f1e75e930c742493a0bc51f28b1ba367f1e0e27d5275965c5ca41f1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700491555, "uuid": "73573b4d-8439-4d01-863a-7a3a33eaebb1", "value": "T13905F43C1B9E0667FC79D6A7EFE08127B160AAE7F119DD24D8D703865702A02B4D427E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700491555, "uuid": "8f69cd53-33d8-48b5-9735-5e151a4bd8e5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700491555, "uuid": "0521c2f3-962b-45a3-bfa6-b257f58dd879", "value": "24576:kDEJtusmZ5rrQOG5NVcpIeY4wrPxeb/sw3EF99r:wCDmZS5rn4gPx632r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700491555, "uuid": "2bcfd787-2fe4-4dbf-8150-f0606918b014", "value": 850432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700491555, "uuid": "1a6d407e-560e-435a-9fe3-87abbea93b63", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700491555, "uuid": "2b29174b-72a0-4c3a-ab43-601cb6eaeac6", "value": "rContract.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ea29f86-87c3-11ee-8907-42010a9c0042", "comment": "Malware payload (NetSupport)", "timestamp": 1700498420, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700498420, "uuid": "e125dcda-44cb-4259-98f6-ef2628757e2e", "comment": "Malware payload (NetSupport)", "value": "df8a729b54c46b4727141b7077fb0c0f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700498420, "uuid": "94e2b34a-5444-40a9-b6b4-1795a07fb251", "comment": "Malware payload (NetSupport)", "value": "2d635db5f9c497abaea60ee146c3274b5f0d9cfee7b97a95c88d7d6ddbab69b0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700498420, "uuid": "fdfb2e2e-2946-4003-ae7e-02bd76ce1573", "comment": "Malware payload (NetSupport)", "value": "d12d3e33d4be860d0338bd4b1627447f70f42caa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700498420, "uuid": "2440d32d-4730-4394-90f2-1b40183ffd46", "comment": "Malware payload (NetSupport)", "value": "7118f52414fa46e60ab02a62f7baa5247245ebc3752eceaa319c5acbf09cf7f2483b30ed8ace2cb1b4c3c607e264a1b9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700498420, "uuid": "6f201c63-2757-4833-8225-33fd3c6ff512", "value": "T1B2A52261BBE0DDB1F12124337961A23C66FA7C10DEF484AFD38EA519A9721C062F1E57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700498420, "uuid": "95330b1d-7fca-421f-b95e-f56f66003d6c", "value": "aac51396886833dc961fcd7aab7711e4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700498420, "uuid": "c5540492-bfc1-4d70-89ce-6b36673018ee", "value": "49152:3dPBDJkP0SrSzXcW5FLEg95FnkLl6XVQsZL2UvMSvWLEU+thP4Gz2e:3NzksSrmXcA7p8l6GKDTSb+tJ5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700498420, "uuid": "2dcb8897-c6de-4f0f-85f2-71a2eeaf4680", "value": 2154556, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700498420, "uuid": "80055026-f41e-4e62-9930-a9b466bffcf0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700498420, "uuid": "03b204b5-cda5-48ac-98dc-ded9df43725d", "value": "situationlaboratory.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df7c0a4f-8785-11ee-8907-42010a9c0042", "comment": "Malware payload (AsyncRAT)", "timestamp": 1700471954, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700471954, "uuid": "8766bc61-1ab5-4e98-b392-79d63680518d", "comment": "Malware payload (AsyncRAT)", "value": "4b2104ce25ffe623a5592ec9f8d02c48", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700471954, "uuid": "8fa20705-837c-4193-9586-d5b1352410a0", "comment": "Malware payload (AsyncRAT)", "value": "2d681d4588ae9a1d9ac26cdc89902d6520c500f38aba2e90a14a5139eb64af5f", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700471954, "uuid": "e71ab0d2-8deb-461d-868b-fcd855cc94e0", "comment": "Malware payload (AsyncRAT)", "value": "e40d3054d6c779ffa5cf8a4d924d0cd31d25537c", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700471954, "uuid": "90e3ebb3-ecd0-46ec-97c9-1311eda5a2e9", "comment": "Malware payload (AsyncRAT)", "value": "160b894acc0f8259de60e85e4215897769d03e07e50d40b546e0b052bfc12b18576dbed5977f5b1e012a4dfb186c2fdb", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700471954, "uuid": "aedfa7a1-cddf-45a8-b263-75f9efdd1109", "value": "T17EE48B9E0DC79998924D852A3A02E13293DCBF77D8EF60645A8390DB04F3FB975349B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700471954, "uuid": "95c81046-d083-4099-84a4-42cd8daefab7", "value": "12288:o+x48PQ0D1VF5sh0cxATT/WQChQEJsbs25A1h:o848PQ0D1b53cxAyh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700471954, "uuid": "fb01dbe1-fd17-4b9e-a1d9-e006af508924", "value": 718234, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700471954, "uuid": "8593ff7a-d056-440a-8851-8512717503c8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700471954, "uuid": "29584f57-bb57-43ac-89a7-8ae0303f9d18", "value": "BO.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb2bbb93-8771-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1700463303, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700463303, "uuid": "9a20aa7a-95cb-4e6a-8ff3-3d4bc844f10d", "comment": "Malware payload (AgentTesla)", "value": "35536db2c50ebc2a9b2eb854f56bce64", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700463303, "uuid": "fabe15e0-b444-41fb-bc0e-3db083d1d7e2", "comment": "Malware payload (AgentTesla)", "value": "2defbac598a365c0fc0632be4235ec9c067a829aad1a7c9cfc3c3bb78ce646cd", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700463303, "uuid": "69d7cce4-94f8-440a-8295-098b02359263", "comment": "Malware payload (AgentTesla)", "value": "3a03bffc44e725ecb0d735cedddf472063ef8b6e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700463303, "uuid": "ac6cb3c2-860c-4e91-9bde-fa616dba89db", "comment": "Malware payload (AgentTesla)", "value": "83abf10b27ac8bbebfccdff753de67e35863205d63682cd8a0219841b68359d30c7b674cab055a3775a7c6947ff5429d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700463303, "uuid": "8c83703a-22ed-4939-8faa-5add6353026f", "value": "T1A615373D1B9E0667BCB9D6ABEFD0812BF461AAE3F2099D24D4D70356930294370D427E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700463303, "uuid": "9f13ae07-a91f-49c7-9227-46503ad53b31", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700463303, "uuid": "70499470-a3fc-43e9-ab6a-82e2b865d95e", "value": "12288:hCNBa/mFiTEJ0+0OR8FCko0s38vd/lMq3PEjB+DOcs0cwxEin7v9vbLRC6guKedD:s2jJ3PEd+yc+i7VRRgVdhFlDZ9VnN+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700463303, "uuid": "5a4afdfd-562f-4415-9ed9-60d50174c768", "value": 943616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700463303, "uuid": "ae14b117-6649-46c7-8424-d467dcc98811", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700463303, "uuid": "bb5436c6-95a5-4f6d-99b4-b32fb74dd84a", "value": "1MARI SH.P.K EUR 3520,00 2023101812011.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29fb5b77-8773-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1700463919, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700463919, "uuid": "bca89bb3-7a2d-47d2-9228-c6394075490b", "comment": "Malware payload (AgentTesla)", "value": "4b1269989d8277505e63abec1b5d43b4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700463919, "uuid": "7d94cd8e-8c24-4d2d-b655-d6783689d260", "comment": "Malware payload (AgentTesla)", "value": "2e37cff1da0032c8316841d8f7f14c6f6243bcb2d2d6179f79023cf2d71a6b59", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700463919, "uuid": "e5ef6a94-f53c-42fe-927b-ca6e4278e2b7", "comment": "Malware payload (AgentTesla)", "value": "8ee74711bad05d6a49da15ab4393b6c0c273c8f1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700463919, "uuid": "7c9cdffb-391d-4328-866b-e617b1c368bd", "comment": "Malware payload (AgentTesla)", "value": "94e83cbe2fa04b384ba48a9a4c7bacc244700609324f051f6b6fc7d9b60412bc86e1ab9a4323e23a82a4b2d090a59289", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700463919, "uuid": "c3f5a770-5241-446e-9279-7978da325514", "value": "T1B5C42316C8C39CEBD990B4CD8E862AF8D0576C9A74C303DF9B56F0B5864740E75A90BB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700463919, "uuid": "db4b99a4-3821-4398-be39-c2aa4ebd567d", "value": "12288:W4zlYsu9zdaCdgzaiG3/E7q1xq6QuIRwQQ7bKiPrfZu/JTuL:56sazdae6byE7q1xq5fwQOjhuBTg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700463919, "uuid": "832f80d2-c20b-45ca-9bd2-b83b2a6c5b89", "value": 546341, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700463919, "uuid": "6d0faa2b-623b-40c6-b44b-4fea8755ae7e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700463919, "uuid": "3a010609-49ce-415c-983f-a393c1cd4d57", "value": "INVOICE 327762.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "691e339b-8795-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700478627, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700478627, "uuid": "fbc07808-b772-4659-8108-d5c598b5dfad", "comment": "Malware payload", "value": "a51647307e94aa71ba9b4d860ab63ee1", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700478627, "uuid": "2e6b228e-d3d9-4c26-b3e0-d0a3aa0f58c7", "comment": "Malware payload", "value": "2ed59bb027b77d959153fcec36f4a65551391ab624c313f1ce90561c17bc1988", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700478627, "uuid": "6dab3345-443e-4e2b-b690-238cf59a1faa", "comment": "Malware payload", "value": "cb93981e00abbfeace3c65b74951a0a3e9130efe", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700478627, "uuid": "ad3ab846-3f4d-44fa-8c8d-25202971c9eb", "comment": "Malware payload", "value": "b2da2476b638fbd151cb8aae0723d7ecbd84589cf3bc3cb51fc9df1e2578ae729cc74d857b1353db71426905dc825ef6", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700478627, "uuid": "1e8f2a16-6c9f-440c-aa76-342bb338f3e5", "value": "T1CAD423EB980A49FA5049877CC01D8DB918E18FF6B85769DDC4D318A250F1CC32B9FDA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700478627, "uuid": "7e39d36e-e568-45aa-b4ac-4596a00477b1", "value": "12288:mgddXbnZ/hNKg1bdsJr2miNl1Ms/BMKbG4LcmkS/Jdn4SUtbA:TddXbnJnF4JrUl1wK/n/Jdn4b8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700478627, "uuid": "e7795998-cc31-4a19-a306-d77e8c88bb1b", "value": 625381, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700478627, "uuid": "1a6ed3f1-927e-49e5-81f3-ddecf92b7fc6", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700478627, "uuid": "e5aaa4a3-6126-45ba-a35b-bc1640f2d038", "value": "a51647307e94aa71ba9b4d860ab63ee1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b77fb04-8750-11ee-8907-42010a9c0042", "comment": "Malware payload (IRATA)", "timestamp": 1700449023, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700449023, "uuid": "438d727c-d3a8-4132-a319-abf077248d36", "comment": "Malware payload (IRATA)", "value": "76c144719369a2c045233e9adefccdab", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700449023, "uuid": "ae41aa99-e7fb-4d9d-a51f-bb24d9fb6b67", "comment": "Malware payload (IRATA)", "value": "2f79ba5506bd211b452481a3c2047d2ccda8b44e73e191649b42844e0bad4108", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700449023, "uuid": "86964539-56dd-4496-afde-6f9aca771375", "comment": "Malware payload (IRATA)", "value": "e07d491da478ea3dd315034015d3df155a368dbd", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700449023, "uuid": "9ef185c5-007b-4b64-80c6-9a08bb3041da", "comment": "Malware payload (IRATA)", "value": "a3f98fb749aafdb693733aaf45c7685175b37b3f2580940774c5dab8228379aa7cf5efd6cc9f414867c673539fb51824", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700449023, "uuid": "b77f8161-d2c2-4172-9f73-16fed7cf8680", "value": "T1C336DFC7FBD4A85BC0F35372817653A661474C268B83EBC36904767C28BB5C06F5AAC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700449023, "uuid": "964f90f0-8111-4b6c-84f0-c161684b00cf", "value": "98304:eyDpMtmyeB5X6gLCr8JRaNTPo+lm8t27mdd4wx/BguOq:NDq7udRaNPos/dOwouOq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700449023, "uuid": "875ddc0c-cb7b-4dd9-ac85-a9bf43285bd5", "value": 4985909, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700449023, "uuid": "c4f6c086-fbb7-48a5-9bfc-d14d5502d3b4", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700449023, "uuid": "08111c54-bb20-4337-9b80-eed7f7a49fa0", "value": "app.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86b29251-87b4-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700491991, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700491991, "uuid": "6853ad80-9d4d-4221-964e-49c460f228ad", "comment": "Malware payload", "value": "4721986a88a38d500972e57da76ab6db", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700491991, "uuid": "72f55a4f-eb20-47d1-a41e-2c0deb0ab5a9", "comment": "Malware payload", "value": "2feaaa1d5cd1e65708b153c9783e6b5eb66c03d6048ffb7e656f543806536bcd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700491991, "uuid": "4f6e0533-0d3e-4f74-9d92-961da2e5a61e", "comment": "Malware payload", "value": "4c625e44c38bcfa8fa264dc6f6ed681b591af667", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700491991, "uuid": "5499e25b-d740-485b-bb10-8a1228a6755a", "comment": "Malware payload", "value": "e456a25aa00979b028f46a362d1a47d1ac9256049fb06cf6d7cf24677d836fef7bfe8b52d516e0f684eddc2b4edec14f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700491991, "uuid": "480f72d0-250a-430c-bbe3-c0d8b80c68dc", "value": "T12CC4231A3E098353E06D17BBD073A5880BF5E5D9E978FBBC49DA119D2B813100CEE766", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700491991, "uuid": "2c1c5afa-ec67-4847-8cd4-1003d29c2bb9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700491991, "uuid": "de755962-49cd-4027-a179-7d04ad0bd9b5", "value": "12288:NvCelFxzNH7FKIRJkKct1soZEU8pxrHwCiSBpwSc:NqeJ7TJkVsQJ8HrwCiSDo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700491991, "uuid": "0d138d1a-a914-41b1-92c8-6e7e83c74518", "value": 591360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700491991, "uuid": "0df64a10-8ad6-4337-b32a-9bc91d076e5f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700491991, "uuid": "0aee53bf-4f88-418d-83b9-5ec42c309b29", "value": "Erro in Swift copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6bf964a6-8795-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700478632, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700478632, "uuid": "6c21bd1a-1095-4ae9-98e3-28bfaca76551", "comment": "Malware payload", "value": "5102fb7f0bd2fd75d3b9e3dfaeacb2ee", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700478632, "uuid": "86daabc5-330f-4875-8a9f-40fe082764cf", "comment": "Malware payload", "value": "307cbb13fec9d00e3b2787f369cb3e6b9b50e3c4285f86dfc41bb10533d50510", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700478632, "uuid": "fe6939fb-04e9-4467-a112-0ece3cfc3cf6", "comment": "Malware payload", "value": "ae9c32b8c42aabd9cae257f1f61f071d11d2741e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700478632, "uuid": "0a239fab-7d38-4fc9-ac33-6d82c71f3e4d", "comment": "Malware payload", "value": "0fe8e6ff108ce9e2848e246f9b5459cfd5865c1ff0511aad600683f6f08c6311851a1b61064ce9a1121e6aa5c656415e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700478632, "uuid": "28203d31-6ad5-4b46-96f9-67a7f147f18b", "value": "T16F452306E7D04066E8B26B7408F203530D39BDF15AA8471A1349EFDB5EB3AB4B635367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700478632, "uuid": "30456061-6d46-4004-9f83-ad4b058a67a6", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700478632, "uuid": "89ea8cea-8d19-47e1-8188-22bcaf60701c", "value": "24576:PyykK7Wkyn+D32IpvfYb1knWis2gT3E4jrBrpaU:a8Wky+SevAb1knLgDDjrBr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700478632, "uuid": "c321ffeb-341b-4841-ae6d-650407e8de43", "value": 1200128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700478632, "uuid": "60a27d60-691e-46d7-adc9-b05e3e5ac537", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700478632, "uuid": "fb65907e-ec9b-436d-8a46-37a467f527fa", "value": "5102fb7f0bd2fd75d3b9e3dfaeacb2ee", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "130efce1-8796-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700478912, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700478912, "uuid": "9c20473e-0bb8-48de-9539-e5e9fa050430", "comment": "Malware payload", "value": "9aa4f7a67b86da2e4077a8d247304ef3", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false }, { "name": "zip2", "colour": "#64FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700478912, "uuid": "dfd005c7-5c89-493f-b9da-53c1bd2c900b", "comment": "Malware payload", "value": "308ecba196d13b211029ac04a6c97bfabad6f1432374fb16c64b61cb3080920a", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false }, { "name": "zip2", "colour": "#64FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700478912, "uuid": "47ddba44-5df9-49c3-8c55-ede91a48a97e", "comment": "Malware payload", "value": "94a38259287f2cbac2781e43a53080932957501e", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false }, { "name": "zip2", "colour": "#64FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700478912, "uuid": "d89e4cf7-c115-46e0-90dd-aeed1fad58c7", "comment": "Malware payload", "value": "322fe97bd104838f5d7bfce53d9acd2667564119c944a2e5b185af4c31bc4fe24ef7f64d1e7636c6c91cdcb537fc45b1", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false }, { "name": "zip2", "colour": "#64FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700478912, "uuid": "c0871c54-8ad2-4a08-909e-e9a661f66d48", "value": "T1FB853344A0A6BDD3F0929CF59518A6DAC2DF38D8DA9A0DC68D0DD3714C17BC187B2A1F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700478912, "uuid": "07013180-99c0-4ce3-85b1-df6bca90db2a", "value": "49152:sXRplRNcT2I6PvJCOqvsBQ8R1b1jYC/7c5p7x:ElRiS3PvJ9qE7R1JcVpl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700478912, "uuid": "e59da8df-9d96-48f0-b6eb-5510e8bac340", "value": 1725742, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700478912, "uuid": "4d2728eb-c737-4972-9f6c-0fff273e34c2", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700478912, "uuid": "1ad8dab6-d4b4-4c99-967b-d3b66438cd2e", "value": "rete.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f782cf1-87b7-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700493187, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700493187, "uuid": "559853b6-a728-41d8-8293-8756579ed96f", "comment": "Malware payload", "value": "e0e1e4aa472b0bcf592af108fcdf3766", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700493187, "uuid": "3da954d0-6a28-4d57-858c-cfb86e7c95d5", "comment": "Malware payload", "value": "30c134a54ba31202c19aa3ae7ed6b246ad462b1b930e6c26aba0cb616da4ff05", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700493187, "uuid": "0aaba934-f7f2-4baf-b3b0-c04f43c485dd", "comment": "Malware payload", "value": "68ee1d50ac00f2955a64a706c11051fc0868ad52", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700493187, "uuid": "36aa98c6-48e0-4d45-9580-15d73836b12c", "comment": "Malware payload", "value": "05b41e1768e042ab95aac505beec6f1b5860bac51fc42b993967fd29e2ebc1d046672e7dc417459b66c2d0eb891fd56d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700493187, "uuid": "8e05968c-8505-4661-a368-20ca96cfbf73", "value": "T103E4128029110F21DDBE13B685524F5107BA466F796DDBB4EDE7D0ECAB42F828A10F27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700493187, "uuid": "6b6f8049-b910-40df-8ec3-4bcf7006671b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700493187, "uuid": "43eeb49b-20db-4b26-8a03-699e3f8d7944", "value": "12288:EeQXucvCeAeQseQGliPMg/VcrVE8xPvnv9884YYCydMqBFkg5wmc0Q9nqzBm1Vn:Ee4ucqeAete5WMQV7Onv9tYdu0/Gt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700493187, "uuid": "d76de516-bee4-4204-bb78-596f0829a5d8", "value": 696320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700493187, "uuid": "ae8cd2a8-78f3-4456-95b5-aeaa1cd24297", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700493187, "uuid": "93a894ae-eea2-4927-860c-fde38f8cd392", "value": "Quotation-List.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b5ba872-8773-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1700463948, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700463948, "uuid": "b7cbfc50-5c09-4b5a-ad30-2cfa517e53a6", "comment": "Malware payload (AgentTesla)", "value": "25088c05f64a194d04b834b34d28733a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700463948, "uuid": "f6afdf83-370d-41cf-98cf-36acf2dbb295", "comment": "Malware payload (AgentTesla)", "value": "31a03630dca6c8f32208c7864b5f07e4f54a9998a192a96e2ea1810827598506", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700463948, "uuid": "6a41f331-d576-449c-867e-baca61fca6b4", "comment": "Malware payload (AgentTesla)", "value": "50750c127726174772881df99a6b053c16269194", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700463948, "uuid": "378beb37-5423-4244-bbe4-6a526fd47792", "comment": "Malware payload (AgentTesla)", "value": "3d2996be2e81b97788fcc96c7a2e0e8fad05d3fbac109dd671f523ae935ac6fb54e30556f5d179fc3a5f5a3ab6022590", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700463948, "uuid": "5e2d1e01-c937-403c-8544-406635a321f4", "value": "T1FF8423AFD376AD14A6985BEA00127C425F83F7D5AFD297BF8A24FF5C5C039802A05478", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700463948, "uuid": "b2c168d5-c114-4f22-be1a-9b1e61c9576b", "value": "6144:2fcdeec2Y7yscKQCF+O7ii6HLOle9BEjj8mqU2hbymWBnarVjMbPWSsbIwkZzXr7:+GyZTQCF1iUe9E4ovBarVKWjsrZHdb1P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700463948, "uuid": "24987565-18f9-46f2-a7b6-2d0d566d1046", "value": 393160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700463948, "uuid": "41f93480-746f-4644-9586-c160254fe806", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700463948, "uuid": "af0b8037-4de6-4e8e-941a-f46bb87e2bfb", "value": "poc.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7296ebb0-87d3-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700505272, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700505272, "uuid": "a3457de4-33b0-4f65-a751-bafb5e4bbf2b", "comment": "Malware payload", "value": "b6c79124ea1a3fe376a857d20f55835f", "object_relation": "md5", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700505272, "uuid": "c69908ce-3778-46e1-96b2-03172bbece11", "comment": "Malware payload", "value": "3240fa8a7d35b4fcc68ab299df0a438a908b0ef7978a3807736b248e8d5b2c4e", "object_relation": "sha256", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700505272, "uuid": "d2dd18dd-dc0d-4370-95a1-b97d7b17e94f", "comment": "Malware payload", "value": "49698fe21992c2acc74ccf207809649f55ac3b82", "object_relation": "sha1", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700505272, "uuid": "eda6c998-e810-41a8-a596-975d4c6c123f", "comment": "Malware payload", "value": "696dfbd8553b1a1ce255f605f1d55fc3bf61e8def375899efaee5ec5c6421ee00d1f3fcc5f29b2cbfd2d35c1993ae1ae", "object_relation": "sha3-384", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700505272, "uuid": "38588296-264b-4ba6-b414-cea389de04fd", "value": "T1251723CBD6EA86E8C4830B50299713CB35C4B16B86AD495E3ACF5C067821CAD85CF777", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700505272, "uuid": "e5ea2455-d81b-4bbb-8672-8123e6ac7f61", "value": "39ca3ea6180bdec1c43734b0269b7598", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700505272, "uuid": "462250e6-73f7-4faa-ab67-5a87e501066b", "value": "393216:P7c2v+mr4EhTssGAm2/BEeQBc9EwJCJqLE2uTuE1i+9d1:zhv+mr4EssT/4aOw9kto+H1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700505272, "uuid": "904b80fc-efc7-45ae-af20-6c445432683a", "value": 19224880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700505272, "uuid": "e8072d39-55cf-4340-a2d2-1af076e73512", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700505272, "uuid": "ca351d51-bd2e-48ce-b7f4-f9680c033ce7", "value": "ChromeSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e14e4139-8767-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700459072, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700459072, "uuid": "55418531-5b9f-4a04-b2fe-2f5de60319ec", "comment": "Malware payload", "value": "c565f5f06b8e4edd2c0a23272f4ca8e1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700459072, "uuid": "3d5b9b51-4914-4caa-9c8c-9a16d7e3b03d", "comment": "Malware payload", "value": "324fd27ad88e78d45943411efe7715775c36e2fff3f4469c9f44241fb1664e81", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700459072, "uuid": "73327a72-9ff9-451c-b37d-b62532144d48", "comment": "Malware payload", "value": "70e4bc4979c64f985dd66aa0ae76d0fe77ce5814", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700459072, "uuid": "200cf393-0a1f-43f6-8e4f-1d6f2e43ad4f", "comment": "Malware payload", "value": "e5a797a8c94cfa09a77485dd5a7826b2518b48fbeecaa65f340516f0119b0370256ebe8a88d0392cc8415d865329d249", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700459072, "uuid": "0f4d482e-1f9b-4465-b3ab-c33ffe36f6a7", "value": "T17B559E71B502D037E1A101F5A67D9BA612A9BA301BAB08D7B3C05E3D95F2DC36235F27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700459072, "uuid": "63690ac9-c7ec-4343-83fd-9af86b3cf093", "value": "7482a1595744a3c77ac9461f3f27a729", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700459072, "uuid": "98f4c08a-f3e9-4574-8db8-40dfba23e811", "value": "24576:NmmEs2wqfcRBxJCBEmAMpCOJMbgp2kvB1Pj5R+d3ThJgrU35Zln2i6:8dw/IyPxbgp2iB1Pju3TIrK5Zln2i6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700459072, "uuid": "29ab6ba9-dacf-483b-81ce-bc9d51ea591f", "value": 1322367, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700459072, "uuid": "f0a14395-eb32-4343-9789-515e61721184", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700459072, "uuid": "0fb2f4b1-8dc2-4f4f-8665-b9ccd74cade6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c2361f8-87c3-11ee-8907-42010a9c0042", "comment": "Malware payload (NetSupport)", "timestamp": 1700498416, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700498416, "uuid": "435f58bf-a1ba-4d4e-9b83-ed3c0319a291", "comment": "Malware payload (NetSupport)", "value": "ec79b502e9f944632bc3216e21ff1be4", "object_relation": "md5", "Tag": [ { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700498416, "uuid": "db079787-7f11-4010-91c5-4c6e2efc067c", "comment": "Malware payload (NetSupport)", "value": "329b8b9dc66925028faf001eb42a900d144baa4e558ada514c96fe7357f2ec95", "object_relation": "sha256", "Tag": [ { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700498416, "uuid": "c7a94dbf-91aa-4d37-9cb6-5adc9ab022f3", "comment": "Malware payload (NetSupport)", "value": "d13c6ba8eadbb35f7e4c38743ead8d74a4a29e05", "object_relation": "sha1", "Tag": [ { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700498416, "uuid": "8c6420fa-15f7-4438-b9dd-42ee979684c9", "comment": "Malware payload (NetSupport)", "value": "b66c8fe99996a8d95df4b15b840a0fb70fc63aab4edd2a43613a43ad190a4d75be02b0574995b5d4d8ab5e5f882bc857", "object_relation": "sha3-384", "Tag": [ { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700498416, "uuid": "c5718cc8-60c8-4d11-a2c4-b0efae259f81", "value": "T1BA95330E5281E6FC57A11ABEFDE3603DD09D01C0B83DD4BE14BE3256B2341A9EA36957", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700498416, "uuid": "08896e8a-5d76-4c4d-91c6-2f82df06408f", "value": "49152:z0f2NgzJUHCrs1dcQ5nLEg9BFhE9l8OjzVQC/iv80lyKvW/EwEphN4GzR:z0uNSUHCrQdcORnwl8OurdnsdEp77", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700498416, "uuid": "32dc017b-b8c5-423b-9d4c-fe8738a0faf6", "value": 1990828, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700498416, "uuid": "4f766223-cc0a-4ea1-a249-f8c529e6af14", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700498416, "uuid": "d38a4898-9ab8-4259-8872-29851dc14111", "value": "situationlaboratory.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c920f479-8762-11ee-8907-42010a9c0042", "comment": "Malware payload (RemcosRAT)", "timestamp": 1700456884, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700456884, "uuid": "b551ded8-1653-43b3-b5a9-b756f8ee8db0", "comment": "Malware payload (RemcosRAT)", "value": "42d1e2db7ff5ce4a6663c318eb311e5f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700456884, "uuid": "655bb8e1-027c-432d-ac84-644693d301d2", "comment": "Malware payload (RemcosRAT)", "value": "32d425df1429136fe675bb3c48c62d08cb541a10e2c1f4326ff2c9a477400851", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700456884, "uuid": "99a87546-92d5-4d6c-b2b9-516cda70a687", "comment": "Malware payload (RemcosRAT)", "value": "912b0366bc3752f86c20e269790efa357fc2b358", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700456884, "uuid": "e65065a7-f0f3-4d86-9fd3-9ee3d6a1af23", "comment": "Malware payload (RemcosRAT)", "value": "77c88ddc43691370d338636fa7ca46746fe00d6563201275180fdfe95926b311094eefe4072962ef2362e94e8f6c522d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700456884, "uuid": "42c22099-d7be-4a2a-a8d6-6a8a812cf9c1", "value": "T1793412641711F956E0E090BCDA44E8F25AA97C603D8B6F1E43ECFE17F917042A7CE166", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700456884, "uuid": "2dd1422b-ea27-43bd-8d0b-fbd06df05355", "value": "bc4f8e98d1041d53dd63bfb91ed10d0a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700456884, "uuid": "13edd170-d335-4fa2-925a-9cfe8b2b090e", "value": "3072:UOSI2I7txG68nYrugMZJMfsciIpuKNtrUQlAK3qSjYPS+IAXb3Ixi5eFrgurIlNY:FvG68YrvM80ypnjAedo3qiGUY2ChzI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700456884, "uuid": "a106af04-fbee-41c1-afb0-454878619dcf", "value": 239104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700456884, "uuid": "dd824c7b-a48e-4cdb-a7c0-477352a8f231", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700456884, "uuid": "afa08a18-da11-4ca9-b202-f6ff9cee5f20", "value": "bREF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56d5b743-8775-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1700464853, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700464853, "uuid": "d7193d62-2700-46c5-b040-408c350e66a9", "comment": "Malware payload (AgentTesla)", "value": "c19e3c48e25b2d5fa2f8dc624cf0068f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700464853, "uuid": "52992c53-8861-4759-8716-02ce569060b1", "comment": "Malware payload (AgentTesla)", "value": "3325b93dfac1299d4b8acc70a1ea77ce28b96a6de5dff5c3bd39ccd50642172b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700464853, "uuid": "3d829e3e-60ad-40c5-a742-ba6b3a29c512", "comment": "Malware payload (AgentTesla)", "value": "f338f27770b3057b2add15da77e463b64f64004f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700464853, "uuid": "b81b6b60-223f-4c80-b9ca-a68fe5f3a778", "comment": "Malware payload (AgentTesla)", "value": "a1467b23aaa266b7b1620706dd0762c427caacc0725a082a6cb153ef38177c60972af8e4ed5f3f029017b4aa3619d300", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700464853, "uuid": "eefba71c-6fd1-4bd8-9c69-0a4e4333ca71", "value": "T1F54508E0317D83C3E1A58EB11FCA86B079F136AC98D0560DB0F99B2E93D2355149D9EE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700464853, "uuid": "338ec80d-67c3-476e-9365-0d37ddb4f0b7", "value": "6144:B+Ri237YCVlRXbXVsHmFGW2MYeB9VBFEq9Kin:BC7lVlRbV6W/PlBg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700464853, "uuid": "458492de-079b-48ce-9047-b895a023075a", "value": 1245184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700464853, "uuid": "47eaf1e4-40c2-4e35-9299-594631f272f9", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700464853, "uuid": "158b4b5f-d770-4ea8-bf73-cfd1b7079375", "value": "pedid0_ FETCHA 13-11-23.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41e68de2-87af-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1700489728, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700489728, "uuid": "d48b27c7-eada-46e6-9f3e-826ad410e495", "comment": "Malware payload (AgentTesla)", "value": "42dacb992b188c00f94655af884f7778", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700489728, "uuid": "d341fa84-6e2a-43db-8402-3c09429333a7", "comment": "Malware payload (AgentTesla)", "value": "342761981c08642199e312e11dfb8584c39c36dcf0d9829398b5de8de6302155", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700489728, "uuid": "cbdf6697-e300-4449-ac29-6fb859fa499b", "comment": "Malware payload (AgentTesla)", "value": "c5c0b7df5e2d53036cd2e9d92db794c27eb34394", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700489728, "uuid": "fb55fa44-f323-42ce-9d3f-e605f7098864", "comment": "Malware payload (AgentTesla)", "value": "890ec629ec45e0867d19d25f83b5a6397791bca448e782b7d657243f14b884ef1b90cebfbebbf34c415edd068ba2ae4c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700489728, "uuid": "7cec81d8-19fc-4002-bfed-610c6e2d3002", "value": "T101B4238A74A56739DB2C4BB4016142070B76174B1B6DC9ADF9DEC1E8E532B20CF62F27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700489728, "uuid": "935f0b6a-fa75-40a4-8bbe-f5569ae0f88d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700489728, "uuid": "90f3eaf2-50bc-4738-8049-b648cefd5d15", "value": "6144:CRQzx2+Ce5OMITaR5F49tp1b5Z5lsA2V8AsW3op5P+4X7xAPvejAIaeEwbe4NgL8:HvCeJ0RZ5ls3sW3GL7xAHecEbeLWd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700489728, "uuid": "4b19bec3-4a84-47b4-aa5e-5ce373ef9460", "value": 512512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700489728, "uuid": "bf502070-15c5-4ea0-a3ca-480937e86875", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700489728, "uuid": "4f933017-aa89-42f9-959d-84d78d02c47a", "value": "PO88100020.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49880aa2-874d-11ee-8907-42010a9c0042", "comment": "Malware payload (IRATA)", "timestamp": 1700447651, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700447651, "uuid": "0c61086b-357e-4f89-bee8-82ed1f7cc28f", "comment": "Malware payload (IRATA)", "value": "601c0ef164e21c0054ee508459aca013", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700447651, "uuid": "41571ee9-ae3d-46f6-b327-6694478fb201", "comment": "Malware payload (IRATA)", "value": "3443a6f35fe0a67eca82926719dead31ba13da6d4e261fb90d61fd9e6a393a3a", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700447651, "uuid": "2ddc8ef8-f18c-4d87-986e-d5889de3b5ba", "comment": "Malware payload (IRATA)", "value": "d4d7e0205b2db30ceef608292e24b3b1d223c4db", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700447651, "uuid": "dcde51a8-92b6-408c-bcbd-e60559b7f592", "comment": "Malware payload (IRATA)", "value": "c215b5eacebaed25646601fdca134a40d16f855b48644c67c13cc834256ea27e3ead07ad4298f1940ed12120ca1da509", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700447651, "uuid": "2ef9bdb7-976f-4294-bfd7-be20e985cdc9", "value": "T197851253F6B6E917C832D07225951738220A5D64CA42FB4A294837BE78FFDEC4BC26D4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700447651, "uuid": "a5051259-55b8-4dc3-ba83-e92c0243ac87", "value": "49152:BsFkkzEXspvewlPxKSPMeALgYtbE7DE7b:4kkoXove6PPPpALgY1lb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700447651, "uuid": "23bae32e-7478-423c-ae09-a9db43741906", "value": 1777141, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700447651, "uuid": "f3524796-e467-475b-a0ee-b0a015fdaad9", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700447651, "uuid": "b00a7a55-dc0b-4e2b-8405-c9e2bd4f9307", "value": "saham.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74c9d853-8771-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1700463185, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700463185, "uuid": "b1026ee3-9300-4ee7-a11c-7738f8c29d91", "comment": "Malware payload (AgentTesla)", "value": "c615986a95cb15ce6a4f25fb0be44d2e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700463185, "uuid": "bc6085c9-c602-4b72-a094-3525a5d8c4d4", "comment": "Malware payload (AgentTesla)", "value": "3521eec33a02580fcbbe9ab361b713360df935308d3480e0c0961c52b0865f95", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700463185, "uuid": "8b4a7f16-7944-4806-ba6b-5e9c234c9353", "comment": "Malware payload (AgentTesla)", "value": "079e03dc9aa1574245f567ce5e115259ce9bef3a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700463185, "uuid": "ca0b0543-78e6-4a92-838b-07be5bf02f1a", "comment": "Malware payload (AgentTesla)", "value": "0d1238a72186e40fdf8fbe2a760bc93b7ae7eb7ea7c6997ee40f90e6d935abe6041a203db434369935b6d24354d64690", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700463185, "uuid": "163520b1-5783-48ba-b4dd-10d1a422ffe2", "value": "T1C525383D1B9E0677BCB9D6A7EFD4812BF061AAE3F2099D24D4D703559302906B0D827E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700463185, "uuid": "0f27d313-a3de-4d66-bc7a-6657befa2194", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700463185, "uuid": "e330950e-c9b7-4c61-82af-ec14a83cfd5e", "value": "12288:c2GBa/mFiTEJ0+0OR8FCkoOreiYoUM+OOhNOA/gD4HNr+RjQp77Fstr7jqZTbdGx:jfYnOOhUAeSNSB077FErHqZTb4x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700463185, "uuid": "a4bdd639-e3f8-4294-9d00-159a48b9a725", "value": 962560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700463185, "uuid": "aa40d98e-ca17-479a-acca-2e93f7828622", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700463185, "uuid": "27202d10-7625-4948-8b2c-50979127464d", "value": "PO-68723.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aded7317-8770-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1700462851, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700462851, "uuid": "9496a6f0-5f07-408d-abb5-2d378ea0b63c", "comment": "Malware payload (Formbook)", "value": "fd13063b7ae017a9f540e0979a0edb6b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700462851, "uuid": "01acd2a1-fa8c-4eef-952d-c06b89df002b", "comment": "Malware payload (Formbook)", "value": "360937271a1d61e89c3be7d77f79c686292a3feff0a4b1f53d1999b51c0037fa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700462851, "uuid": "ae0ff3f5-f54f-4b6b-ad0a-a5c928603836", "comment": "Malware payload (Formbook)", "value": "adf76157eed26468c1a6af8a5f0339c2110e7540", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700462851, "uuid": "a6d7b852-4181-41ac-9497-e17d41675945", "comment": "Malware payload (Formbook)", "value": "70e86e713c0c826a05429ec1e4118fdd0950337b17ece9c755b0e223b216734f2d6f81e4e5cdb1b47bcbcea09210cc5a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700462851, "uuid": "d181c3ac-7d0d-427e-9d6f-794aa973f84c", "value": "T14AD423D523B85626C8E2CEBA9963509196F927C2E012CE1CBFDD20CE47733721F597A1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700462851, "uuid": "ebc5016a-5238-420a-83e1-6eefb801d521", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700462851, "uuid": "f29392c1-3e29-49c9-b436-e0ef87d6b4d1", "value": "12288:KytsJ8EzDvCeL19VO2wBj/lYqXjHwSNC6QAKxwpe82uYaCOkcBWxkbQwUWtINzrx:CqeLrVPw1/iqXscCoKuhpYkkccxkbQbH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700462851, "uuid": "dd492d98-3073-4e61-bff9-bd82d58321d9", "value": 641024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700462851, "uuid": "ad8884ef-df7d-45c3-87f8-4e607c03950c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700462851, "uuid": "e4c84d99-5817-4c2b-a2f9-b6adfd777dd6", "value": "DHL Receipt_#89391500.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7914c0a6-878c-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700474789, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700474789, "uuid": "cc0a0e7f-8a3d-477f-a5e5-b0489fee1a92", "comment": "Malware payload", "value": "5a8861a3ebfd55d681d61f0afa70257c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700474789, "uuid": "f8739c0a-a647-434c-b18e-de160dde7414", "comment": "Malware payload", "value": "363c1f120597ff012268e72d8ce57242c7bece16098cc97db69d8124038cd41f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700474789, "uuid": "a0aff978-e168-49d4-bfc7-5d4fe18b75d3", "comment": "Malware payload", "value": "7bd5bc4b40d2621b3f2517aa589c4d68c6505723", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700474789, "uuid": "f992dd29-406c-4b9a-a877-a79f0112231e", "comment": "Malware payload", "value": "2be3bf6b6ab8048815ab1a9e3d509c2c41e401065f7ff645af15180bf90146dd6dbadbbdd3407a933d4c34d81ef7b4b5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700474789, "uuid": "408f187c-8a68-459b-a1de-01aae60848d3", "value": "T1EFD423FB32A010ADDA9FEFFA1652D19407F82FD695A1D91DDD82190C99722120EC7FE0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700474789, "uuid": "45568749-cc0c-4767-aa33-ccbec15fb9ef", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700474789, "uuid": "940039f4-40da-4978-a086-c97703aeebb6", "value": "12288:lytsJ8EzTvCesk0wi+duoz69n3PW351y8J8bXTFGJyzAVUQbqeMc:Dqeh05+IozCn3PWp88absysVUQbqeM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700474789, "uuid": "4587518e-f972-4b8c-9d45-9b45e5e70007", "value": 635904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700474789, "uuid": "4c86ca11-4f39-4fc8-a16c-e7204fef011b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700474789, "uuid": "aa858e2c-34c3-4602-b7e8-fde8b1a70e8c", "value": "PO 5500427059.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "229a19c7-87a8-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700486669, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700486669, "uuid": "8e3d8902-a8e4-4073-acc3-1ad029ee4bca", "comment": "Malware payload", "value": "dd85c40d44cbe918ce58f154d3469461", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700486669, "uuid": "42ec38f7-b1e5-4a88-8bd1-992a08d5fa83", "comment": "Malware payload", "value": "3665a41374b9b77f594fe118728ff5ffbd741aa6a7534088b4940d0f4f1015da", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700486669, "uuid": "b5a6af32-856e-4b48-99d9-a886f3a5c74a", "comment": "Malware payload", "value": "1b8f96ef569a838fa01608434bc37d9cde6d9b13", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700486669, "uuid": "0bfc8eca-3c76-4e34-b770-b2b43d9ca1ed", "comment": "Malware payload", "value": "af77c30a3224020916a4d39326d4731f9b583f435e53f4f08d52df19ba7699792b0bac7282224e6e514de8c78276e8c4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700486669, "uuid": "e6648cc3-f2c2-4976-b20a-450145ef7606", "value": "T161350192E93EE703F31DD9BA43C61446E1069C5B0FA8CC25CA5C5F26495CC742E3BE6A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700486669, "uuid": "1ed45d26-f864-49d2-afc8-4d547952729f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700486669, "uuid": "71f3d497-6aef-4542-8917-94c66223d333", "value": "24576:1xUiYMTTSFId0vX0J2GDM0C2lQkvupnFQDFcrCyAB/MuW:7hT+Fe0vX0J2GQ0tl9KqCrCyAB/xW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700486669, "uuid": "b37be3fa-c327-4513-aaf9-a47a9cd8e275", "value": 1083280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700486669, "uuid": "cb8a9329-57de-4a14-9058-701b3a92ea50", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700486669, "uuid": "57907e3d-d5c0-406b-ad9d-8b43f041ecea", "value": "KvbxbkyXYy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b16d25b0-8787-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1700472736, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700472736, "uuid": "c86c7564-2c69-4736-b29d-a6be0a6424c3", "comment": "Malware payload (Formbook)", "value": "e9b01654e3374f748b573b66bdba9889", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700472736, "uuid": "ef131cc1-f14b-429c-a812-48937756c10f", "comment": "Malware payload (Formbook)", "value": "38687f648dac2391e0d3510baab25f8ae4272a41d2f378314a36a52362f7d442", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700472736, "uuid": "bea6f948-47a9-490d-ad58-eacf62d844e9", "comment": "Malware payload (Formbook)", "value": "7d6a2396e107fab70c503e9f8ff90fd38901fbc7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700472736, "uuid": "fd30c1ac-5ce5-4e0f-a272-30d25a3f41ca", "comment": "Malware payload (Formbook)", "value": "709d0b9bd274691e497d52c3e6e15c1ee84e8c9dd441e3fe8ffe73bfa9d6b88759dfe6150c50ec152ec3323d79ce4ec1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700472736, "uuid": "6a02f25b-0277-4ec3-ac58-d6a5b4dc58f8", "value": "T1F7D4237635108A73D59EB5F121E95D4013BBF9AAA813EDBE9CC600EDC9D5FCA48011CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700472736, "uuid": "7c417a76-e776-4226-9e78-8d083c9dc423", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700472736, "uuid": "08fed68c-2a5d-4c0c-bc60-7cf7be0e51d9", "value": "12288:GP361h61EWG6DWPQT46+APmle/X6gstgulpfcHgc824IOXOCxpqx961:GaY7G6DWPQToAnsgujfczjOXOCxcxU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700472736, "uuid": "ec95de0d-507e-481c-b9a1-ebba373c63ee", "value": 633344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700472736, "uuid": "6c8a2c2e-576f-4338-9bd7-9683fd981b94", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700472736, "uuid": "68e2c872-b6aa-4444-b259-e4dc49455bf6", "value": "S009892823151530,PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70c6e6ce-8772-11ee-8907-42010a9c0042", "comment": "Malware payload (DCRat)", "timestamp": 1700463608, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700463608, "uuid": "266242d5-2614-47ea-8386-a0a417921513", "comment": "Malware payload (DCRat)", "value": "b0be5ff99aa4c436482991d47c20cdc8", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700463608, "uuid": "e82baa8f-cd51-4daf-92f7-68ef23977c52", "comment": "Malware payload (DCRat)", "value": "39ba27ddda1d3fe75d11abc68af9953848c5c6887039f30910587208103a8d4d", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700463608, "uuid": "7a86e636-2baa-489f-b1d8-f95e9bfd144b", "comment": "Malware payload (DCRat)", "value": "ce520a3a41196df75e02e74d453c051c37f2909c", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700463608, "uuid": "161b2bee-6a1b-42e3-b88f-eabcff319e33", "comment": "Malware payload (DCRat)", "value": "7cb2eecd814886697bb2370424a158a9113d16ae0c490706b118a9cffb27562422a8c1e9d60e261c44ad4caf9bac665e", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700463608, "uuid": "22d49a4a-8a81-4144-affc-5cb2a12fc7ff", "value": "T12BE52312F5D184B3C5671A312635A71571BDBA782B65CECBA7C04B0EC9228F1EE307E6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700463608, "uuid": "5c1b6f6d-6d7d-4df2-8001-103df4fee70b", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700463608, "uuid": "28f569df-be56-479c-b34c-13209c69088a", "value": "49152:FBSo7NPTcvMwCdL8c+2lV4ITcYBkj3Ag1ZcniVKcsDqEWVwfwyNa61hn9xb4ceyx:PSuNo0ecVleIDBkj3IAM5WVPy51h7Obi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700463608, "uuid": "d260bfc8-688a-4b49-acdd-6528def44c7e", "value": 3117124, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700463608, "uuid": "47df2183-5b85-454d-a762-57b850c2cb14", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700463608, "uuid": "aa5a32a0-7459-4349-9c0d-2f8ec15eb46a", "value": "b0be5ff99aa4c436482991d47c20cdc8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71fd54dd-87b3-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700491527, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700491527, "uuid": "a1a272bd-43f2-4561-abac-4dedbc919d89", "comment": "Malware payload", "value": "14a45a3729844001a029fd6495b45ae5", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700491527, "uuid": "a2876aef-192d-45a7-b16d-f3fb00c7b8ef", "comment": "Malware payload", "value": "3ba056010a8e511e192c1606567d0dd6fb89fb30013a2a3f49ae02d7bd5ac97d", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700491527, "uuid": "79d6c8cb-6d1f-47e0-8a47-4c2e883e3b9a", "comment": "Malware payload", "value": "d9031f6502a3bffb6112ec2ecad9a6b0310379b3", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700491527, "uuid": "6d80fdf0-68dd-4b2d-96bf-1d8ea1f8fba3", "comment": "Malware payload", "value": "f6473e9d7d4ce1010d14a0eeaef23f4caa51bb0676fb2869dda02e6be92474b5e13b45911d5a5ca5f929c5efa45f2f09", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700491527, "uuid": "f47fad20-c1c7-40f9-a8ba-4e3607139cf3", "value": "T1A356E020BB91C236D8B615B94DBEA39A597EBB702F2451CB73C40EDE0E315E5AD30217", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700491527, "uuid": "f95f6cfe-57f8-4f02-a149-e6a8708cbf10", "value": "49152:abezE8JYy3o+w+X7gJhHcnsZ9UwgV+Ujga2IDoncPieZo0g0IvHnfY:abIJYBf67gHlUBV6DID1Zo0Ug", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700491527, "uuid": "8155dea1-0dfb-4f05-94a5-f144d4091748", "value": 6291968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700491527, "uuid": "7e27b63c-2e44-46a6-bbbd-4ee0ed4f03ff", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700491527, "uuid": "0690b7fe-153b-4e73-8471-4a1c23870a70", "value": "entrate.vhd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4992a39-87a4-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700485304, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700485304, "uuid": "57c6c48f-bd94-438b-8ac8-9f8f5ac9394a", "comment": "Malware payload", "value": "111a51917160126faf0de997749c4a84", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700485304, "uuid": "d39dda7a-797b-4fba-8bb3-a4361c4187fc", "comment": "Malware payload", "value": "3c18e64435871f8e9fd9c1d379f6cb76f4a5e8c5734386ff9ae10e35fb666112", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700485304, "uuid": "d1cb8326-8824-443d-906c-55fee504423a", "comment": "Malware payload", "value": "4b872bf6d21caa3e3c56b380ddf0f7accb3343de", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700485304, "uuid": "0ca510d7-ecde-47f4-b144-da9e1952ddb9", "comment": "Malware payload", "value": "e86187f47a38856d1bc5470be9e10f14fd0309913ac2410c84f50093907936e26a296dbd3bf08d6c25784584f24dc207", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700485304, "uuid": "cdc72cb6-e9e2-4603-b419-9c4bd992ec3f", "value": "T167D023490A4FC176C0414817D058BE5C9C0DB54415E1C85CD280E5874C510D0DC4D6F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700485304, "uuid": "55d85005-076c-40e7-91c7-ad3117385b9c", "value": "6:HRYFJb7z9sZOMNd0deo/Iyc1yc54vVG/4xHn:HRYFJHzFA2UoQhy3VW4xH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700485304, "uuid": "03b4a8d6-6bb5-41e0-9ab3-47727faec11d", "value": 204, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700485304, "uuid": "734a5b88-11e2-438f-9f65-bcd55d7cd3f7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700485304, "uuid": "786824d8-d802-4edd-b9e6-d81da54f4f5e", "value": "Agenzia_Entrate url", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ffb874d-87a8-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700486853, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700486853, "uuid": "7d2e7506-95b8-4b4a-a2dc-453fdc9dd761", "comment": "Malware payload", "value": "8c37343c1c7107120625fe5bde5d9f0e", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700486853, "uuid": "30bd4ffd-add5-4aca-bfe2-5c37a42489f7", "comment": "Malware payload", "value": "3c2fd36c401963cdc4697b985e75637de8159ed8f2ba437be82f2786b1965b95", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700486853, "uuid": "0d68f29a-dbbd-4094-8b05-9eceb3c078f7", "comment": "Malware payload", "value": "ea461f17acf434e35b2837f0c0b819e805cb755d", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700486853, "uuid": "16846188-2268-4b22-97f6-4623ba266e09", "comment": "Malware payload", "value": "454a707eda8827aebc1ee14b6871680a1218f4b146afa4a79d7c2a494933064606bbb4c6b4d7c6a0a3ff079d04bf77fb", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700486853, "uuid": "1a558992-e430-46f6-901e-36ca055d5262", "value": "T1B82533F467FC5943842B7450A6030A143056FEA8CCA76E60B368D6BC5FF0796EC7B629", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700486853, "uuid": "640bc02d-60df-4fa0-b070-d272dccbcccc", "value": "24576:Ql+oNHVzrKKzQOaG2SHIVO5OIoQsbh13HE6Xpp9:Ql+2HVOKzyG2xE5orHnXF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700486853, "uuid": "2c55f96d-1a08-4b26-bad5-f89febce4c2f", "value": 1032426, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700486853, "uuid": "6d5eaa1c-91fe-4007-8dc0-4dc23d0ef421", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700486853, "uuid": "7b216bde-1857-4a84-a48d-f61f67eb6eb1", "value": "SOA OCT.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "375945f7-8771-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1700463082, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700463082, "uuid": "ee76c615-536d-4324-9f31-0133ff3d26e1", "comment": "Malware payload (AgentTesla)", "value": "d33d4e3f2ee5d8629f2deedbdbfe5199", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700463082, "uuid": "d2f272c1-dcda-414c-9c86-508ebf0e8875", "comment": "Malware payload (AgentTesla)", "value": "3d05623da2f66ee7073d88d4e4703551e779a136d0296f8d4073c52c93a469a0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700463082, "uuid": "5e76ebda-7988-488e-9eb6-8c1bcef742ff", "comment": "Malware payload (AgentTesla)", "value": "f3ca6f75cba4394e2b52792c12bd0988673e7560", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700463082, "uuid": "f9211075-2f87-4cbf-87b9-bba8c09baeb7", "comment": "Malware payload (AgentTesla)", "value": "380f1b8cc75ab08a8ac9a37c785886cd4fb7c8d17e7de56b872dbd60ad223759094faaaa584de654b3318bfc8c374ceb", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700463082, "uuid": "4ae7c709-5f84-4f73-84dc-8eafaf984de4", "value": "T117F4F63C5B9ED26B9DB9C6A6CBC1C41BF340B9A7320CAEE5ACD30355931291674C523E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700463082, "uuid": "9233224a-010e-444b-a2a4-29df71049f6b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700463082, "uuid": "53f22264-37d5-4077-8406-37358824ee8f", "value": "12288:6elc5Fqrvh3ukGR8FFkbYJeu+yk5uvlWwjFLGTe/+SSS3sOiVdiaPVm+Z:yfuvRVMcflcOCicJZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700463082, "uuid": "e09bd582-9e97-4689-8f63-4b25ed46c43b", "value": 759296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700463082, "uuid": "49ef32bd-d083-4123-9ddc-41ed8e022b14", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700463082, "uuid": "8f084cc2-f826-4548-85f6-13329c3e3b71", "value": "cargo_023354663.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64665973-87b3-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700491504, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700491504, "uuid": "3ea9f3fb-71fa-4bad-bf9a-2c1c01326574", "comment": "Malware payload", "value": "5f485a5808bc1de58df63ceb949b850e", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700491504, "uuid": "fab0f81c-bb6c-45cb-a391-9d89bd26a430", "comment": "Malware payload", "value": "3d39d6df58edba7289a16126befbba677e82d1ecdebaf1a2d8ca03ed05ab2a79", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700491504, "uuid": "44b128af-2b5f-4c8f-90ec-baf056dadf41", "comment": "Malware payload", "value": "a49de040773d554b920890e7aed6dcf76e99a945", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700491504, "uuid": "d64e95a1-93b7-4505-9623-cb9e6a32e98b", "comment": "Malware payload", "value": "e36c90526f5b36dd877f0f4274c36c6f6dfb7305de180d79563460c4b8034f32201e74c7c2c3087ee87b5075390b8319", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700491504, "uuid": "161ee40a-e2f6-42ab-b9d3-7c7fa5493b0d", "value": "T193A5332A52D7D063B9E8E8B94AC3B72ED0941D57E2660ED71FC27404D786803F31EA9D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700491504, "uuid": "6edb3b37-64de-4b4f-a6f2-e2c719108177", "value": "49152:hOn0MPD+c25TuUxL4uWJHgRg4ztlFFZ4qmytrQVQMmdevXqYgnexG:hHGyVHxU5JADztVZ43GpBd0Ul", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700491504, "uuid": "4d92299c-b6d7-4651-a748-6addc57f57f9", "value": 2137028, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700491504, "uuid": "f66fb5ee-d6be-4322-b990-8319ba236fd2", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700491504, "uuid": "30a86e32-42ca-41d0-a349-ce3f25c02e58", "value": "gruppo.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3f23ff7-877f-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700469304, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700469304, "uuid": "6a56f243-fcd6-4691-b1f7-adb0cb377f3d", "comment": "Malware payload", "value": "99a565b6b0c23c17c03f5caf8a2d40a5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700469304, "uuid": "a107b557-c993-4fe0-b536-d5c179654ce6", "comment": "Malware payload", "value": "3d5f0a30adb02d1e0ebc1a9fab66764f3c9b988e4157061be91f15c6a76a0619", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700469304, "uuid": "d6a3ca34-3fd5-4bd3-af5b-d88f224e3f31", "comment": "Malware payload", "value": "f5ccaf7c059e883a8dd6bee2671587d98cbd8ee1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700469304, "uuid": "aee4e9d3-25f5-4192-9033-d0031771015b", "comment": "Malware payload", "value": "7d128461fa70da11a8344ea9efd392e08b2a498db70f5175e74e12ec078ddf9509e5862a5fe923c0c477fa3e3fe0f5e1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700469304, "uuid": "dd38d0a7-4727-4e42-8e3c-85643d6e21c5", "value": "T11FB4AD2033FA1209F9BB4B355DB691D15B77BE2A7E0ACB5C1545030E1E33A52CB22B67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700469304, "uuid": "83f6bc28-d931-4da2-bb6b-40bbbe801a5c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700469304, "uuid": "4d5cec9d-3cbc-4776-8165-e84c95fe15b5", "value": "12288:/1/3/4z7mwUl9v78h/qUVIiY29mK15B61:/1/v46l9v78pqIId", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700469304, "uuid": "565baeb8-29ca-4691-a7bb-d063c8b430aa", "value": 542720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700469304, "uuid": "61e2d408-7ae2-46ca-b238-aae028d70c84", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700469304, "uuid": "7e14a7e1-9248-455e-b650-0703d8241c83", "value": "commercial invoice and packing list.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9d30bba-879a-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700480937, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700480937, "uuid": "685b36f1-e3ff-4347-8496-730564859c74", "comment": "Malware payload", "value": "aa90f740f20462601a90fafdf37a4b82", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700480937, "uuid": "b45d4f88-f76a-4818-9ffa-8b887de8d21c", "comment": "Malware payload", "value": "3d6f60107b831b2c10f7788c2c47f9ca6c3804b42f83e77c6e5e9993b7392378", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700480937, "uuid": "11711cb0-5f78-4b59-b862-05a68e536734", "comment": "Malware payload", "value": "a023179e41c2d6d0d809b5bf37bb84e0d5f40d1d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700480937, "uuid": "eff47f24-fae6-4b5c-980d-162ef5572554", "comment": "Malware payload", "value": "02694c8d7f934c7f8835d16e5bd77219406534fa5353ba3eb6531d772d4bb9f7b63f650e73fcaaf013f323e50ca351be", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700480937, "uuid": "8d08aed9-fc5c-4dbe-b116-6b7444674867", "value": "T14924CF2276E5C032F167453449B2C6B65A37BCB28B7195CF27D01BBE0E216D2CB7931A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700480937, "uuid": "ad2de5d4-d797-4dce-b806-c2a2c1482349", "value": "225c0a302d7e57a1c8187a7075db5d12", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700480937, "uuid": "0afff632-1c10-4df7-9673-6aa804f572c0", "value": "3072:tDO17emGta474RR+LJu0QFwyJXI6eWNrGIXm5Vs2aCNGBQZXXv/xs:oemqa47wRwJutFty6nrGGAN9N5R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700480937, "uuid": "b1395a9d-b1c7-4d6e-a3cb-1533e4d9e5d3", "value": 214016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700480937, "uuid": "f39b8e89-779f-41c7-891f-9e9561a389d8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700480937, "uuid": "9044ef24-eb76-4362-bfbc-37f1db58f0c0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "238e147b-87af-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700489678, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700489678, "uuid": "69605200-0f21-408f-bc6d-d36deeade685", "comment": "Malware payload", "value": "1cd4b47ee586f70170c9ceaef114c0fc", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700489678, "uuid": "1f9642be-fe91-4e06-8169-db50cc711ade", "comment": "Malware payload", "value": "3dc233ce3f959ebee1d4ecdfb2410d960955355d6c52ff96ba96502391be47af", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700489678, "uuid": "5a6fc294-1c8f-4bb0-9a6f-57420085b56a", "comment": "Malware payload", "value": "5396ece91e65b83f441c89da7e671ac32edb75e5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700489678, "uuid": "1ef122ea-d55a-49de-bb62-6ce7814b04e6", "comment": "Malware payload", "value": "31162be99cb91b8a49fb89439ed03cbf394c75bc9b4ed5095182618b271b8709b049492c5b8f58d76e7b556f62eda3aa", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700489678, "uuid": "a6d55206-3d16-481b-bee7-870d0fc0f6b7", "value": "T11694E150FD9DDF22E57257F665A260634BB1238E2221D50C1ECA31E7C531F432A82FAB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700489678, "uuid": "cf19eddb-3bb9-44bb-aeb0-8bd0e0c9d19f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700489678, "uuid": "df257d60-ae8a-4a5d-964f-32ca8fa60e32", "value": "6144:2Dmad57XePl3DvJxWcvJJaSQlUIYkmhol6GSKpWfZiLcTHhs2R0nmw6iBY:2KVDW5Uhkh6Gsfmssis68Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700489678, "uuid": "b6540df5-f89f-4159-b9d6-dfeb5fa9deae", "value": 427008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700489678, "uuid": "beed1df5-bdff-4615-a52f-8260152f9d14", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700489678, "uuid": "94b0f15f-52b0-47e1-8f34-df75b4acb744", "value": "Invoice #80752.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cce1bd17-87af-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700489962, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700489962, "uuid": "2d954c2f-eadc-458b-8f9c-7fe34095dae2", "comment": "Malware payload", "value": "b8ab53e5ef6341216620cde1e99a87a7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700489962, "uuid": "288fcd3d-f881-411a-93f0-6eb2769d7db4", "comment": "Malware payload", "value": "3e60e5325c114ff38166e824e4aa95b71077d1e740a9b5966797c9541ce2e1ac", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700489962, "uuid": "4d39c9e0-fc25-451e-b4ab-70736ff9a47b", "comment": "Malware payload", "value": "2e442698f1dea4efd4a4b13571cf89177b4aa3ac", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700489962, "uuid": "6e7a0687-4a85-43b7-bf63-6ca294a2167b", "comment": "Malware payload", "value": "2147029ef53c41bf94e90e8dba947e6fc985f065fe9dd5d50f6cc18fd1bfc8b0d4ead822906ecabd3a5fc27d3253d1cc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700489962, "uuid": "043e93b3-c37e-4de0-8306-cce776a8f227", "value": "T1A1E4DF41F493FCB1C05B383FA854C657DA6C2E18176ACB6737C0DB77B26A6806F20966", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700489962, "uuid": "8fd55e73-5d34-4f1f-8b0f-22bac5ec68eb", "value": "7ed4424425b48ea37bca233b582a59aa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700489962, "uuid": "f8fd46c3-a475-4737-babd-911245a467f5", "value": "12288:eX6g8YkMxEot/+JVPwp+wg/bbJ89DyF9EkJd0ZaFBR:eNaot/kYe/bbJsyFhr0Za/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700489962, "uuid": "418bfc6a-f391-4a68-9e8c-9fe62863d315", "value": 675328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700489962, "uuid": "ffd73cfd-d7a8-4efb-a1d5-c33a35f97b50", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700489962, "uuid": "fd76c7eb-6d27-4458-a4c0-5a18ae68dc91", "value": "b8ab53e5ef6341216620cde1e99a87a7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3294d493-87af-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700489703, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700489703, "uuid": "7a827fe2-a55d-4d39-8940-210762802209", "comment": "Malware payload", "value": "3f6d2aa85fcd8e38412f4ab60f8f47f4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700489703, "uuid": "f7aebbec-0b8e-4ec9-8413-81c6c82ee9d8", "comment": "Malware payload", "value": "3eb644492c55f3afab73d0b9842a835d67ccf35c46767d45ae7d2e78fc96d7e5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700489703, "uuid": "eecc804a-f8e0-411e-9cbb-f95ec93e49a9", "comment": "Malware payload", "value": "7766ac3f9692746896f25ee85eff6b063649dd12", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700489703, "uuid": "e66ae14d-3c56-4fd0-8e2d-713c1be8db4c", "comment": "Malware payload", "value": "bba45bf72a218d60dbdf5a307ed365ae265d983c0834e12138ad9731ddbbe8e594cc5186876bd33a77e6a5b59e0d58b2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700489703, "uuid": "a42972e0-5676-4bcb-8103-c02a886e98c5", "value": "T14BE402417685C4B2E0A2183435E8D7B5EA7DBD711B65D8DBB7C00F6F1AB48C18A32E0B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700489703, "uuid": "eb21de43-0d4b-47d0-b0f6-e83c8dd4728e", "value": "411d07b56145caf2dc98484203a9ed7b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700489703, "uuid": "540cb294-d041-4b3f-933d-11488ae79828", "value": "12288:R1nGfvqfcZCnVsUonX/hNKo1FdsJt2m2Nl1KsHBMIDG4LcykS/xXn8SUtbR+i:RrcZ0VGnPnveJxwl1uu/9/xXn8b4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700489703, "uuid": "5457be70-a971-4298-b3fc-a2015d3c6d91", "value": 716288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700489703, "uuid": "ac1ffa05-137a-4b15-9a74-d12843a02ccc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700489703, "uuid": "fbd8295e-2001-4dd2-9b06-c284e78cbc27", "value": "SecuriteInfo.com.W32.PossibleThreat.9320.29901", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7eb39440-87b3-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700491548, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700491548, "uuid": "e6a4bb46-0178-41ff-9a9f-5eed1077e3f1", "comment": "Malware payload", "value": "1834ebb6c7c481c77c050a2a13e69da5", "object_relation": "md5", "Tag": [ { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700491548, "uuid": "28896169-948e-4adc-9b99-beff8c7ce6b6", "comment": "Malware payload", "value": "3eeb2464510a994ee5fc18f01439c716c1b4b24c6f26184af48855b9ba2ba786", "object_relation": "sha256", "Tag": [ { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700491548, "uuid": "b65abe9d-9b89-4e26-9fa4-2e6b4bb59282", "comment": "Malware payload", "value": "16c92f28291b43392eeccc9164d9bf893bee0ac3", "object_relation": "sha1", "Tag": [ { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700491548, "uuid": "04441f7d-8971-4a84-a720-2d199139387f", "comment": "Malware payload", "value": "aae06ba584548ad004e12b7e57766f26efb0d4c30c89adcb0230bebcac1086b8fa3dc3728534d24c0c94a035b6af3dd4", "object_relation": "sha3-384", "Tag": [ { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700491548, "uuid": "f978f16f-5a66-4bfc-b32c-5d5b4a380ee4", "value": "T158D4333D3DCA465A12F6BD8FE26C0A3E76769C87D29727574C65C780E4C3BB12206392", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700491548, "uuid": "a3832d48-5e8f-4ccd-b53d-df9c125d79b3", "value": "12288:43FHjNmh0cYTV49JAXlIX+xg9u87gZzty1RVPT9jzb/J:41sh0FJ446X+xiuEmpcr5vB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700491548, "uuid": "03f0cfc7-cde3-4023-a1dd-dd90865121f4", "value": 603692, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700491548, "uuid": "b061e9a4-833d-4018-83d6-f182ed893e34", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700491548, "uuid": "a07714a3-5164-44ac-bf78-a1007509ccf7", "value": "nTT Swift Copy.pdf.z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50efaba8-8773-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1700463984, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700463984, "uuid": "b6f2c7b8-7161-4d49-9083-83b2125a4eb6", "comment": "Malware payload (Formbook)", "value": "74071c62962498e648e6b59c211149e9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700463984, "uuid": "180db303-324a-4282-8e4a-ad3db0503e6e", "comment": "Malware payload (Formbook)", "value": "40f66f55c4faa23570b8b288dc1d9e59f7c2405725581a523931a9f3d9d8fcab", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700463984, "uuid": "151b9b15-9ecb-4e28-a6d4-0d49ad77b4d4", "comment": "Malware payload (Formbook)", "value": "26cdafbf5c2efb606d5b92358b322e576debd0a1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700463984, "uuid": "6d093a11-336a-455b-9167-12ff9bceaa99", "comment": "Malware payload (Formbook)", "value": "349cd6785a97406546940bcc0d0ca3a0aff42297e931e27ed56191f167bd3ebf72db81ff7d8395cc3e95749ab8d4fdc7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700463984, "uuid": "10f0a8eb-5137-42c3-8f00-a044ce51c0b8", "value": "T1A735273C2B9A0667FC79C3E6DBD09127B6A1AAE7B119DD24D8D213C65702B0275C423F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700463984, "uuid": "da3e2962-a655-442e-aca9-2978c14a592c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700463984, "uuid": "8b9cad62-426b-4031-bf2d-2365b70283e7", "value": "24576:TTlE8npgWh/FUAmSxo4WA4Y8AhoFnN8iIgm8zL2ePkj:FE8nyWLNKnY8/T13m8zL2ePU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700463984, "uuid": "adba7c7f-4c7b-4651-a482-6445a1297e04", "value": 1153536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700463984, "uuid": "8fd6de2f-d203-448a-a42f-b595893b98d2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700463984, "uuid": "fd1c9246-5da6-42d1-a625-3eb5c3ffea92", "value": "th\u00f4ng b\u00e1o h\u00e0ng \u0111\u1ebfn Awb#_82879440291.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15b8da05-8772-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1700463455, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700463455, "uuid": "d4e93126-b261-4754-92da-8944aaf740c3", "comment": "Malware payload (Formbook)", "value": "82cff5feef3192ca45e48aebd8576d1b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700463455, "uuid": "a510a89b-b11f-4e2b-a38a-96a33afb5cd3", "comment": "Malware payload (Formbook)", "value": "4166ad5cb4dc5c1a94846632840494ae95cb1677130a11443889af9a9c44e8e7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700463455, "uuid": "e2168017-6b10-4b41-9736-5dfa56ae1ee2", "comment": "Malware payload (Formbook)", "value": "832a8565799dc46ccb4c0460582b5a0d82e104d6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700463455, "uuid": "cbcc48c2-b3f8-4854-af6a-44d721b70e29", "comment": "Malware payload (Formbook)", "value": "24c1e091469a626a401a38b599c111d2cbb6557b055cb489d622edc238812ad76d9a8d078c211c54a7e53492c52241bf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700463455, "uuid": "5652cbdb-7dcb-44a2-b040-1edea4099ad8", "value": "T1C9F4F43D1B9E0667FCB9D6A7EFD0812BF061AAE3F209AD24D4D703559302A4670D427E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700463455, "uuid": "982f5cdc-8b38-4bc0-8b40-38e83013b8e2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700463455, "uuid": "b583732f-c1dd-4e56-8c74-3ff0c9a02273", "value": "12288:ImBa/mFiTEJ0+0OR8FCkoYclnlDZnofg0nqRSgGpNYfw5UOQattamnkWJiyAl:4Itxo40nQSDLz2OZfkWJlA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700463455, "uuid": "463e3dd6-2487-4197-9c23-de87e58aa834", "value": 784384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700463455, "uuid": "a66f1364-a7e9-422f-88cf-610b3a6ecbe8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700463455, "uuid": "2af4b711-50ff-474e-a256-2280225c448a", "value": "AWB 9899691012 Clearance Doc_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02d6f59f-87bb-11ee-8907-42010a9c0042", "comment": "Malware payload (RemcosRAT)", "timestamp": 1700494777, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700494777, "uuid": "faea50d2-3a90-4b00-b1cc-739afba56992", "comment": "Malware payload (RemcosRAT)", "value": "ea6bd2b0b90df4f86296ad73f540b734", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700494777, "uuid": "d3cf323b-6afd-4584-a3bc-8661f34cae02", "comment": "Malware payload (RemcosRAT)", "value": "417f6284c3c8c25c8b4520cf02e6edc06f18ec73d11ff1cd15caf021a7561496", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700494777, "uuid": "a20c356f-22e3-45e0-946c-71623d592c74", "comment": "Malware payload (RemcosRAT)", "value": "81de764a421c57afff793d8b4152c94af28886a6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700494777, "uuid": "671d6581-29bb-4622-9d0c-5efb601222c8", "comment": "Malware payload (RemcosRAT)", "value": "8d72cbe92dfc20c880bb4cd04ae8cff6dc2a78fc24e59a8b03527314e0e7622634a77b5794719d6a72ce4836847934d1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700494777, "uuid": "df5d6868-538d-4a07-8ad2-835a5fc61891", "value": "T1CA25120BBB5C839FD396977A357A52728458DF834A40681BB6D8FE9D293234DAC033D1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700494777, "uuid": "2bc82456-da60-4abe-b64f-085d1a826cf4", "value": "4ea4df5d94204fc550be1874e1b77ea7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700494777, "uuid": "8965ab3f-bf60-4e54-816d-2b2c6c59b397", "value": "24576:WES1OrA0XH8r7auf2nlywHTRbPFgYfHYnhA:NS1mAKcH8fRbWAYnhA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700494777, "uuid": "dd3b1529-f870-407c-b034-7dafd7a99a21", "value": 1008640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700494777, "uuid": "776941e3-3ec0-4f4a-9da5-dec8dac44ce0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700494777, "uuid": "a5a9e893-3bd9-4174-9513-753e69da14f8", "value": "z38DHL_Express_.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "057d791f-8771-11ee-8907-42010a9c0042", "comment": "Malware payload (GuLoader)", "timestamp": 1700462998, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700462998, "uuid": "d57a61b7-dda5-47a9-91d5-07bce6b274d0", "comment": "Malware payload (GuLoader)", "value": "a8c45ed92bf24531147743b8871b2309", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700462998, "uuid": "858c06ef-e356-42ca-85a1-98d80b24465a", "comment": "Malware payload (GuLoader)", "value": "42e4f70942b020996643aefe856e575e9a9dcac88115d548d598c51e521b427a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700462998, "uuid": "2074d2db-f8fb-4f2c-96a0-1e1d90097f09", "comment": "Malware payload (GuLoader)", "value": "997a7509ead70360c590978cee52de407a0624ef", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700462998, "uuid": "d3c79960-a079-422c-aa73-b8408b711181", "comment": "Malware payload (GuLoader)", "value": "f8988a4c0573d308f97eca8ca290281e3d2dc839bfb9ef97ef6d15c158f52d3017a23eb415b075c4344e54db4f3402f9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700462998, "uuid": "7a9edb52-de40-4e34-8512-766aad617522", "value": "T1401512211ECAC83BE26F493926E1FA35C99FCC2805E38012D6FF9D53B2347D5396A161", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700462998, "uuid": "04f18830-b811-40fd-b096-eebbbee4bb80", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700462998, "uuid": "ededdc4f-49bb-4a2c-bc12-4bd849f55980", "value": "24576:W2B5zJjjDGv1Hdvfgih3ihW9NVBDxyPvAYZ:hBPX61Hdv/3ZOPv9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700462998, "uuid": "e2ed23c4-a624-4eef-8e29-418133a6a636", "value": 934273, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700462998, "uuid": "cd1996eb-f047-42f8-86d8-52f4605ba321", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700462998, "uuid": "702b9f8b-040a-4c29-908b-9cc3d585685b", "value": "ekstre.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2921170-8781-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1700470241, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700470241, "uuid": "c74b61bb-da2c-4e86-ad74-16caaff38f6f", "comment": "Malware payload (AgentTesla)", "value": "dc160ee6134fec5c35d7af4049d4e776", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700470241, "uuid": "4791265a-aadd-4cb8-8341-12d86b82462d", "comment": "Malware payload (AgentTesla)", "value": "43456ca9a4bb3e0570211c5120caf389756f2a38a6dc38290471a1f58e9fbbfb", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700470241, "uuid": "1aa71558-d237-4aa6-9957-138801556791", "comment": "Malware payload (AgentTesla)", "value": "323bc8880d3a66a20299e22ca119571c354bf185", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700470241, "uuid": "bb6e97b0-f5e3-4017-8810-cd3ee5e43027", "comment": "Malware payload (AgentTesla)", "value": "faa4de730cd35cf00729664ae3d350ef81a78b96b590efcc6c67da300c52284bf3441a0ccca07fa72ad1bcd63586aec0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700470241, "uuid": "500ba443-4ed3-4b57-89b1-93952c94c2ba", "value": "T1F735DEB461A4C796D3799BFF646744301B636C1A65B1C39D3EBE30C90DA1B834A80EB7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700470241, "uuid": "e463b73b-c1e3-409c-99a5-1cc4b3d5f38c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700470241, "uuid": "2853595e-f3ce-4ff6-baa1-5e90b8d5fe55", "value": "24576:Dp1l5bd+TsY5PWnFxdysc6pBxQmDb6+EGPr5CP3WDUjmEV2:thLnFzysc6rCmDbKGPrI+DUZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700470241, "uuid": "21fc9f55-71ae-46e9-ae8e-4714d3649ba5", "value": 1075200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700470241, "uuid": "087533c0-6f6a-4d6b-bc86-1048c4f2f905", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700470241, "uuid": "38364aaa-b05e-41fb-93c6-4f960f6492b0", "value": "AWB 5331810787.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e157bbd-8773-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1700463925, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700463925, "uuid": "d67ea8f6-0045-481b-871e-9f2a1ded8898", "comment": "Malware payload (AgentTesla)", "value": "450293dadadb09492bf5eae4ee1cf194", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700463925, "uuid": "0c53aee1-b77c-43fc-81de-4382fb31d192", "comment": "Malware payload (AgentTesla)", "value": "43709291b4fd1aad625bdd7e8cc7d816aa49290412338b0cb79c093ac9a76609", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700463925, "uuid": "180bf04d-689e-49a4-945f-75b91209fbf3", "comment": "Malware payload (AgentTesla)", "value": "26ccc3d7a14fea06c48b958b0af9df77304184d8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700463925, "uuid": "3bd76c66-e392-429a-9a60-5277e3ce18a7", "comment": "Malware payload (AgentTesla)", "value": "1557476a6dbefb597690cd29b8a9ae3b2e086dbf9188bb29449d7c46a98d3f336810b75cf1c5d1ba44749dbe64871a7a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700463925, "uuid": "fafc965c-e7d2-4563-982a-b42d950f2a95", "value": "T135C4239579928967CBD8B8FA0493254007B7F0998C63C2DE8D8A70FD07E9F47B5016A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700463925, "uuid": "1cbb4018-ed07-4b5e-8815-38c2f36ef010", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700463925, "uuid": "3a773897-d9f3-453f-9a93-e518600d99b1", "value": "12288:o3361h61EWGpKrIxNuMs7dlCdopaiIt/E7qvxqwIuIrswG4Wtpp0cV5LQ2c61:oSY7GcrI9s7dleWbyE7qvxqNFsxLtpWO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700463925, "uuid": "2f2a040d-4dc8-49e7-80dd-17e2e5e889a1", "value": 585728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700463925, "uuid": "ff2e16e5-8fb9-47b6-90be-9f7729812335", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700463925, "uuid": "fdca3cad-47c7-4c08-a62c-0dde66767f17", "value": "INVOICE 327762.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "571aeafd-8796-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1700479027, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700479027, "uuid": "d3fa282e-a491-4300-ab43-76d71c9d4179", "comment": "Malware payload (Formbook)", "value": "2b8fa1fb91177e751ccfd2022d20e1be", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700479027, "uuid": "13a1aa00-2bf8-4a70-9271-1afed8386542", "comment": "Malware payload (Formbook)", "value": "4387bd3be9d60c37c800ea3d0949e91556cfa29e69d35a4a18c657f41cb9f4c4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700479027, "uuid": "485c757d-21dc-4b43-b0a1-4ddd47d98455", "comment": "Malware payload (Formbook)", "value": "808855d569d26b729e2b6c6db15c11a8d7c7e992", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700479027, "uuid": "5f7d7eb5-bcbe-4d52-afb0-913e00ff166f", "comment": "Malware payload (Formbook)", "value": "83f47225ba1e4475431dd4838f34c41ac86cd30b6313755f257101d57c94e9a9cb7982b9cb7a14a56b7aa0098d3680e3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700479027, "uuid": "14dce20a-8f69-4f49-a5f1-6672dbfb1a95", "value": "T154C423499ED407B4DA3C47FD4A5BA210475D9A6B2AECC2FD1DD0618211F1B230DB37AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700479027, "uuid": "c1052a94-61c7-4b94-9820-16d95c65a6a2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700479027, "uuid": "589b1263-f286-4f7c-a686-11c982c306aa", "value": "12288:tvCeNBz93IMDikLiN7ffWu1Ufg+3V20ImocOSGUdzqX:tqe7+MDiFN7fuu+HwJNu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700479027, "uuid": "7ea48eb5-4246-439c-a4b7-b3fd5aa15fdf", "value": 594944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700479027, "uuid": "f982fe70-877a-402d-8d09-35f7048c2107", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700479027, "uuid": "b070532f-f7ea-4a40-a4a0-7def16a528ff", "value": "SecuriteInfo.com.Win32.PWSX-gen.23598.30908", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06bf5778-87a2-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700484046, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700484046, "uuid": "b45c1a5a-0673-4ffb-914e-4af1ba337015", "comment": "Malware payload", "value": "4d962c7113a94d156e4f0d77b8177129", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700484046, "uuid": "3b14d496-bc3f-43e8-8a03-3293888c5396", "comment": "Malware payload", "value": "444bcfbcdf9e927948f5c18484aa809089638f3a8e0ad4e174c4612dc13f4852", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700484046, "uuid": "3fd1d686-c755-4bfe-9b15-29ad0a9d880d", "comment": "Malware payload", "value": "0a1e894f32202852fe817762f67455c6e7f56d44", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700484046, "uuid": "d48046c8-0ad9-4419-92f6-42ddbd91cf6d", "comment": "Malware payload", "value": "f7ae1d26e6ca5355ed77a3981064079fe3795e68699269b84f805be01c93bdf67a7212c8348b93bf7d1a9c471053df85", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700484046, "uuid": "f7a03cec-efae-4b01-9aee-dc3b2d02823a", "value": "T108D423FA8191909ECC5FAC9AA38BD752278C3FA855F0643CC123A805E97D00FB6C7D54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700484046, "uuid": "f3a531c4-5cd3-4608-8aa2-02d81cda0b98", "value": "12288:Cu2y9rn1Zow4+p7oan3fb5lyeHCHdjFGJyjIVbpu/UgUOcFYY:TT1Zol+Roan3ftMeiHiy8VMUIg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700484046, "uuid": "e6c61691-c5b8-440f-ad5d-ae353f4bd8aa", "value": 608515, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700484046, "uuid": "e9e63eb2-7cfa-4a55-9333-1d2adada5247", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700484046, "uuid": "fad029cd-0e43-4ff5-81db-d7668173c9c9", "value": "New Order.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf713ef7-87b0-11ee-8907-42010a9c0042", "comment": "Malware payload (RiseProStealer)", "timestamp": 1700490369, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700490369, "uuid": "a2349619-c534-47ab-90d6-1c597b8c4c41", "comment": "Malware payload (RiseProStealer)", "value": "b696e9b9f359da82c1f8be1f7fe1b2e0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700490369, "uuid": "b3d9f9f3-f721-477c-aea1-6082062f7e22", "comment": "Malware payload (RiseProStealer)", "value": "464685877c6f193ad2f446db2124951ae8161e3f518b08529124aed64adf3142", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700490369, "uuid": "f1e5d52b-1ecd-4487-80e6-6254e9af8224", "comment": "Malware payload (RiseProStealer)", "value": "0ca06d734ef98e1b6a22fd275d5508175390e00d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700490369, "uuid": "cfbce9c7-6847-4e60-bc78-76b38e2bf247", "comment": "Malware payload (RiseProStealer)", "value": "b3a4672a8a9a1bc0ca448b5bba78dbd1ed6424bd12c8c565f531ca80af5c6ab817f69cf6afc53558136f49c2b562ad96", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700490369, "uuid": "473df07f-f6ec-472b-8a53-57980df262d9", "value": "T15B559E71B502D037E1A101F5A67D9BA612A9BA301BAB08D7B3C05E3D95F2DC36235F27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700490369, "uuid": "abec657e-a175-4ba4-a388-eb9d023d1c4e", "value": "7482a1595744a3c77ac9461f3f27a729", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700490369, "uuid": "f87138af-45a9-46b8-9b45-5ff2ccc268a9", "value": "24576:NmmEs2wqfcRBxJCBEmAMpCOJMbgp2kvB1Pj5R+d3ThJgrU35Zln2i6:8dw/IyPxbgp2iB1Pju3TIrK5Zln2i6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700490369, "uuid": "9702e9eb-b7f9-4e00-8b69-75571ed3e803", "value": 1322445, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700490369, "uuid": "9d982f01-5a07-4f3d-a323-668168bdf479", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700490369, "uuid": "87b2ad5b-4b27-4810-845e-d931b9298eac", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5bfdbe2-877f-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1700469361, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700469361, "uuid": "a584ce0f-fb83-4afb-afca-6ab947827cd3", "comment": "Malware payload (AgentTesla)", "value": "3ffe2151c425c1aa108f3ee570d339e0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700469361, "uuid": "76a19724-f418-456d-b5da-77b50e808832", "comment": "Malware payload (AgentTesla)", "value": "4722cb29b7819a5ac339733693f3d6d8f2203881cde7219dfde83322ac67da5e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700469361, "uuid": "976afcec-50a8-44a8-bcda-8597ddaaf992", "comment": "Malware payload (AgentTesla)", "value": "257839471a462de83e47c58354c589206bddde6b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700469361, "uuid": "8fd601b9-fb86-4bce-ae65-a171f4e69166", "comment": "Malware payload (AgentTesla)", "value": "007af5eab27d9792805a8826b1be4be9b3346f098ef14e795e742afa32829c981f50f81cad89338c31760f4bb6624712", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700469361, "uuid": "c5198540-2047-448b-bd01-cc3a386ce347", "value": "T13DD4F1AC7650B1DFC827C9768A582C64F62138BB531FD203A05711EDAA0D99BCF562F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700469361, "uuid": "45aab1d3-47c7-4dc2-a681-96d3bdd974bf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700469361, "uuid": "8a3956ff-ee85-44cd-a911-b6c1946d5ea1", "value": "12288:rq1tdJtcbhqclP0mymtv1zbea1EqTO+R0WNm7XYMxt+OdTNo6vJRggRUy609wdjT:I/JtKhtltv1zyavVR0LYkEOU6xyg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700469361, "uuid": "2fbb2c62-e7c9-497e-a894-84f53dfd7e18", "value": 634880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700469361, "uuid": "2d1b35f8-1240-4825-94e9-3823a91a5c0d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700469361, "uuid": "df764b60-904e-4593-8590-045239c6e599", "value": "data sheet.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1bbe1c8f-8796-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700478927, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700478927, "uuid": "59eeca41-1715-4d3f-88b8-4dad3fe0ddd7", "comment": "Malware payload", "value": "457c47ee567f8a7a6644b4d321f8d1b6", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false }, { "name": "zip2", "colour": "#64FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700478927, "uuid": "6b5d99c4-049b-4670-aa82-071160805ef5", "comment": "Malware payload", "value": "492c2a969cbdcf065bb6f6188b69c609b1533e6a7c92364bb10df2632d47e05b", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false }, { "name": "zip2", "colour": "#64FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700478927, "uuid": "26dee557-86a8-46f4-8036-a8bf1561dd74", "comment": "Malware payload", "value": "f5f1c8fd6205a23076860ae64d2764dcc2080d30", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false }, { "name": "zip2", "colour": "#64FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700478927, "uuid": "fe47ed55-ddb3-44d8-9746-10759afe6cc7", "comment": "Malware payload", "value": "da9a4c82a1f69a0adcacdf70cc2cfcf54f1b253c152c7d9818125b93f7ea348a7ff2d5e9039231cdb19afbef6cf719ba", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false }, { "name": "zip2", "colour": "#64FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700478927, "uuid": "a87a05f3-32bf-4aca-a726-c37f83fa3417", "value": "T15E5533D9FCC1A433FA9C10BA99C5217FC92DDD25A9B95311D42401AA6DE3358FF4E132", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700478927, "uuid": "a981be11-8b20-470e-982c-1c933a4f8f7c", "value": "24576:Baa/RBNZKivHfRsuGWiUuGwpnLWr5qn3CiH6wwkLk6U9hreNEvE88NXBDRG7Mf0y:znTvfquGptLC5qnr6we59EDXBDWe0gaE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700478927, "uuid": "7e1af864-0d77-4812-a28e-9ff4e0223e5f", "value": 1318980, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700478927, "uuid": "05376943-92a0-4dc9-a6f5-34bba5fa33f2", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700478927, "uuid": "0750911c-9574-4695-ae94-2f5364de920c", "value": "entrate.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f32c9b26-875b-11ee-8907-42010a9c0042", "comment": "Malware payload (MarsStealer)", "timestamp": 1700453948, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700453948, "uuid": "5b5e0e4b-9af6-40d6-a274-55f2a5cd2440", "comment": "Malware payload (MarsStealer)", "value": "076ac01ea35d4b4a78130ffe0b0da1b9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700453948, "uuid": "1c35d15a-c3a4-44b6-b1a0-63a7e7b150fc", "comment": "Malware payload (MarsStealer)", "value": "4a4edf2b54ebe39c26293d94699b07050709a8549c213f9ac8f344f766707fc9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700453948, "uuid": "198aa949-bb64-40af-ba11-22baeb77b6b5", "comment": "Malware payload (MarsStealer)", "value": "0e20fae40bccd1f9ac4845ec3ff4f29f5b7250b8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700453948, "uuid": "cda7cf0f-7a6a-478d-9b61-7663ecffb567", "comment": "Malware payload (MarsStealer)", "value": "9bcc965de9bc474e5d49724be88f83e097cf84b666f36d147bc3c5db0b32c976ff01e6fbcf7320bf927517a7aa3d3470", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700453948, "uuid": "d3d3b4c4-0b6c-49af-86bc-e9a6c4c6cc2d", "value": "T12314F1C7131E8047DE8E98F6B8758C07382A9BB4E29F805767F1A1A10DF62C61B56736", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700453948, "uuid": "dd4d90f0-011c-42eb-b977-a05aba8183c8", "value": "17a4bd9c95f2898add97f309fc6f9bcd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700453948, "uuid": "7fba455c-6e8a-4800-a71b-f52d892e7622", "value": "6144:h9H1Xawk0LIRwox29ll1NsJF5cnZ1msCX:h9ZauIRwooLstcnZsf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700453948, "uuid": "e210bfaa-2074-4e1f-959b-afaa79826345", "value": 200096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700453948, "uuid": "67adb7ea-7426-4cc5-9847-0788920c05db", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700453948, "uuid": "a9df04d2-6020-46b0-96ac-63e100935092", "value": "SecuriteInfo.com.Win32.Evo-gen.25423.22998", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b8a0a35-8780-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700469612, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700469612, "uuid": "fcadba0f-6878-451a-80c1-b25ec16e697e", "comment": "Malware payload", "value": "bf8b16340d010313b130398ac204a73c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700469612, "uuid": "a8c79df3-3cec-4b49-a803-58a9ead96b3b", "comment": "Malware payload", "value": "4a9bb0feaee9d40d5317a49232e10d518e680b7b8cc57009a19a8800bb27e9c4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700469612, "uuid": "e7e411f4-cfed-4e06-bf71-02a13d1762fd", "comment": "Malware payload", "value": "8097836e773a67d3be0fcadd923ea81fd2a2a8fa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700469612, "uuid": "3eae4f06-f21f-497a-ac93-701a0d483344", "comment": "Malware payload", "value": "c995a99f8f31635554f601ff8e14378b33f9376a617ca120b74a1558e1f752de62f35d0c986e22f2a7caff893e05171b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700469612, "uuid": "dc9baefb-3a1f-42bc-8580-efa0291460b5", "value": "T17DF423B142CD157BF06A6E742055EA67CF3B6000A978E42E2B2958375CF672FD6FC248", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700469612, "uuid": "59e91a15-e440-44c5-8248-3d162711395f", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700469612, "uuid": "9ccb2574-6232-465a-8c2f-c9787797bf1e", "value": "12288:o3KemAPIgJasmNB4fVEJrOhYjtJlcqOO/T3C1DPfXS+7vF52A21GDS6itERh4zig:u7PIgJaBseJrvLltOOr3C1zC+GGOG4eg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700469612, "uuid": "fc500516-85b8-44b5-89b2-ecf37b5fefa9", "value": 775004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700469612, "uuid": "4c90a236-5a0d-4017-9c1a-360bc53d8668", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700469612, "uuid": "de6e818b-c867-4c28-849b-a45ef926f727", "value": "QUOTATION_TML_617740.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "caaa2a0c-8766-11ee-8907-42010a9c0042", "comment": "Malware payload (Smoke Loader)", "timestamp": 1700458605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700458605, "uuid": "11d825ed-23e4-4034-8ff7-3bdb86952dbf", "comment": "Malware payload (Smoke Loader)", "value": "50638a91e34127b6e8da9e00adc5d443", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700458605, "uuid": "8115b9e6-88e3-4059-bb3b-df1a9631c2c3", "comment": "Malware payload (Smoke Loader)", "value": "4abd157267e0e423d698f49a60011c7d0c9fc30e21585ff42f974909e37bde4d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700458605, "uuid": "a6efbf95-fe70-419f-9cb7-b01ae8c98ee8", "comment": "Malware payload (Smoke Loader)", "value": "daebc5d190afc76e45277cc9c8203cdb750a3183", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700458605, "uuid": "f420172a-d6ca-4ad6-adc5-1f8e47862e1d", "comment": "Malware payload (Smoke Loader)", "value": "a5d6b1d738d76ca0182dfed7492015194bd47a52302fd243075b58dcb60875163eaff07c9a1514cb130a01b1b667e35d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700458605, "uuid": "0e6666da-e3c0-4a8f-9c01-a25a5b709b47", "value": "T14CD623F4B2051F03F4F31E6451F094935E6AA5AB3F1EAD35623208EC28A16BEC9B355D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700458605, "uuid": "595a42d0-3fc4-45c1-b2ba-f7d3d23e30fd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700458605, "uuid": "5b39a729-d7f3-44e6-b864-5175e431e376", "value": "196608:tcRpQbXkWgDX5c0qzDZFcwUe0IssLWjRppNaA/vc2dMMM+fBRhu:tqab0WgDpc0eZ+Le0VjzpNlvJO+N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700458605, "uuid": "cae17189-1280-468f-94e7-831074a6c9e3", "value": 12814848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700458605, "uuid": "179ac926-4eca-4dd2-a78f-baa9c35bd4bf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700458605, "uuid": "980c2f47-3f24-439f-964c-60b1454ea1ab", "value": "50638a91e34127b6e8da9e00adc5d443", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b873815-87ad-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700488778, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700488778, "uuid": "2c7adf9b-f888-4472-b3f4-1786b211dd2c", "comment": "Malware payload", "value": "8f36665ff976476c6b2c7666f5f66c88", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700488778, "uuid": "b32480dd-3e4f-4dc0-9e77-ba4cf0e7fd31", "comment": "Malware payload", "value": "4bb7ce35a2d6fc3a67572e1de3daf1a1410f34de3c6036717a64cd7e7437f48d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700488778, "uuid": "bdac7b17-57dc-48f4-8d55-a708c9f97db3", "comment": "Malware payload", "value": "56f4bf542a7f36bfe7a49d1b503bec2814d49191", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700488778, "uuid": "0547c759-a7df-491d-9fb2-03fe7b3e06bb", "comment": "Malware payload", "value": "72d35ebf841fbf5ddee85901554866a77e2915e676a0997e15faf531bd606a52c8b5f2cf633fa6bd0f5f53f1cbe40624", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700488778, "uuid": "438304c7-07bb-430d-8b76-fc79ae9523f5", "value": "T17DB533C493387196D947F5B2123A6D33643F8D3AD13C1D9E742A9E9B24A284B3D7D390", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700488778, "uuid": "3155d073-d1e2-4caa-9ac0-2098a60a9907", "value": "4328f7206db519cd4e82283211d98e83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700488778, "uuid": "3e036a57-e470-4714-b4cc-44aabbffeafc", "value": "49152:ErHC935qTk+OqDS0ITS5rCYUdD0Yb1eydE2ANMM8Wux:Cil+zDX1GndD04eyE2xx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700488778, "uuid": "31b642c0-f748-4039-bccc-d620dece229d", "value": 2438304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700488778, "uuid": "adfa6c25-690f-4146-b625-e3d42d0965b4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700488778, "uuid": "bf76739e-8a3a-47f9-804f-b42126a7913b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afbc263e-87d4-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700505804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700505804, "uuid": "8e3338bf-dc42-4ab8-b5bc-21ba985be3f9", "comment": "Malware payload", "value": "460e31bf26eb4b07639a6d85c46a0d9d", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700505804, "uuid": "1bfed89a-dcea-429c-aa16-b535e16c022b", "comment": "Malware payload", "value": "4becfb0d1eb175ad0c6b3c0d4410fc2476a17f5b77f00d16a5b6c27dfce32fc4", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700505804, "uuid": "c4163a0a-4d09-4755-8179-61a76d644bef", "comment": "Malware payload", "value": "512bb8d73f68373ead7ccc87c422cf44ea8726a3", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700505804, "uuid": "d7d67fc0-1b88-408e-b52e-5a2b4a51ace9", "comment": "Malware payload", "value": "204ce34e3f096ce2af2acc28b037db1841d0f7ee5614e52dd013ad141e439e900de2a04cffb147d1310e1bca64035d35", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700505804, "uuid": "8f5b0152-c4bf-47f0-8937-3e324fb2da27", "value": "T19156E020BAA1C236D8B315BD4DBEA39A557EBB702F2451DB72C40EDE0E315D5AE30217", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700505804, "uuid": "0bcf10e8-3bca-40b2-9076-a084c290fe29", "value": "49152:mbWzE8JYy3o+w+X7gJhHcnsZ9UwgV+UjgaSxKMYPgWsnAEppMQn:mbwJYBf67gHlUBV6jJAEpxn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700505804, "uuid": "5e9117c0-43c0-40de-b351-edb1a55fdca6", "value": 6291968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700505804, "uuid": "dbd9bb3f-afbd-415b-a425-d95c4d707d65", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700505804, "uuid": "01d6a4a5-3dbf-43a4-98fa-deea4812399c", "value": "gruppo.vhd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "590ec689-8796-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1700479030, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700479030, "uuid": "4a24e0d9-c87c-40c9-bf73-e5c70d4a06f5", "comment": "Malware payload (Formbook)", "value": "d9bd68c9c2e2d90cbaad65e85c7e0823", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700479030, "uuid": "87391c8e-3522-42e3-9c9c-da798361ce1e", "comment": "Malware payload (Formbook)", "value": "4c81b7b43f1085404420bc1966807345defd77f944a9306e886f98e6895aacfe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700479030, "uuid": "7c4ee98c-50df-4ad6-b8b2-39dc7dec7181", "comment": "Malware payload (Formbook)", "value": "9bbff7d59024916825e5df3479b695a99ed0048e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700479030, "uuid": "ac9f6b70-1fb9-43e7-a747-a2ad471d3969", "comment": "Malware payload (Formbook)", "value": "00be9e33b591398705de0916f111af99dc86d60d953fe520cb272af6d4ac680c04fe055fb628c23f15f9104e713167ce", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700479030, "uuid": "4cb7d681-af1b-438b-8022-ceb50aa09141", "value": "T110D42341936CA327C87357F548154A1E073379272819F7ACDDCE5AE922A2F120F72B9B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700479030, "uuid": "881fa1bf-8c8b-4b45-967c-a7f9cc3df674", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700479030, "uuid": "396e4757-68db-4ebb-be27-7e3fe7d7cb99", "value": "12288:kEX0CO/WivCe4YdPoHhMRtvxWpF0KIzNrTvR7n+zNy6oX+fO4j0:YWiqe9BoHhMR670FzNczNd0+f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700479030, "uuid": "96bd7189-90eb-4a90-845f-b8efaa502f7a", "value": 615936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700479030, "uuid": "1e278e0d-b342-492a-a425-d96222633566", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700479030, "uuid": "52a2a7d7-bdb0-49b0-9d9a-821b56943f5e", "value": "SecuriteInfo.com.Win32.PWSX-gen.793.23827", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c22b1512-8781-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1700470187, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700470187, "uuid": "bdbc4bb9-f204-465a-88a1-a0e3c3f713fd", "comment": "Malware payload (Formbook)", "value": "d25f471a955b9718f428a7fde21b0f21", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700470187, "uuid": "78230025-34b2-4678-ba83-6dfe03a09e7f", "comment": "Malware payload (Formbook)", "value": "4cffb3c085e77791f93929f5fa18408829750807f7da6ee431a33904d2d1d4d7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700470187, "uuid": "098659e2-6e9b-4220-bc94-d7cdb7bf1180", "comment": "Malware payload (Formbook)", "value": "c93a4b22a88670e04f0c2d449ec0573a727e85dc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700470187, "uuid": "ef849631-9d49-4d55-96a9-368708d3f793", "comment": "Malware payload (Formbook)", "value": "6ee093ddd65848f55b42999931758af621e21b3343cbbfca6a307b944a47a480e53cf82414569e71e4e8d22c5e3f7453", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700470187, "uuid": "d6e91d91-9e68-44d3-adf6-0cc9bc6a0494", "value": "T11DD42346A7B9AB74D2B86BF6187264150BF3A8FF4875D3089DC674D8159BF80C702B23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700470187, "uuid": "300029ae-8d2d-4695-a6e2-fd444d3dd21b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700470187, "uuid": "6dadad1c-fcbf-4cda-b396-26c01152c68f", "value": "12288:DuPvvULP69L/utEWDRSBC3dGv270SKImxkayK23jqk+/QgW3azU:WBRutELC3d3IpI83N23jf+5W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700470187, "uuid": "6c0588cc-5125-4577-b31e-81ef543ed756", "value": 646656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700470187, "uuid": "9577203b-a7c9-4788-8ba5-43872b345be0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700470187, "uuid": "424cabc7-e309-4e18-a850-69716b26ced7", "value": "Maersk_K22TSI714881.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "452680a2-87ca-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700501330, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700501330, "uuid": "2ffad0d4-69bb-4961-9183-094af931720f", "comment": "Malware payload", "value": "1e7fd9bcf7e4c6891c1c826c09217ff0", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700501330, "uuid": "90a31f78-59c5-4833-86c6-a4e24931cb0b", "comment": "Malware payload", "value": "4d3c70c56adac4b118be2c42cab1cd3fb775f5c57ce85041f012d67ba2b73639", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700501330, "uuid": "d612c08d-1178-4ad1-9602-5e1332eb08e8", "comment": "Malware payload", "value": "14ecccbc63f556939817d8c8990f455955b10017", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700501330, "uuid": "4afd1739-d37c-4bac-8ad3-96be28e80d8c", "comment": "Malware payload", "value": "cfe15d98409491490ce8691135d75db363f71e86057b095bccb149de625497001cead4a82d8edc528580a384b321af6f", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700501330, "uuid": "40d08ecd-6216-4efd-a90e-a2113f586c81", "value": "T113863B43FC5181E9C1EDD131CA66D2A2BA707C884B3023D72B50FBB92B76BD45A79364", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700501330, "uuid": "96b02d53-60e5-4544-a995-a02dfb6ac25b", "value": "9cbefe68f395e67356e2a5d8d1b285c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700501330, "uuid": "229b2c10-f36c-4413-8c0c-13923881863d", "value": "49152:HkgmZiw3gDbjrb/TUvO90dL3BmAFd4A64nsfJDwt5lRS4VC3HGhR7NlGKVI0/a7C:Hz013owlMgiKV56dwnEZ7ZOieyMgS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700501330, "uuid": "0f603665-6b53-4cfd-97b6-f8763c7310e1", "value": 8471552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700501330, "uuid": "f22507f9-7cd6-4d5c-bdb6-c319935f75b9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700501330, "uuid": "ccb49f02-e151-46b4-834a-6058bde15e9b", "value": "1e7fd9bcf7e4c6891c1c826c09217ff0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71572870-879a-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700480789, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700480789, "uuid": "cec43bb1-2daa-45aa-9081-48463e8a9e59", "comment": "Malware payload", "value": "427e0f014c493886b69101ca062829ae", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700480789, "uuid": "cac52ac9-a80d-4caf-a4fe-a3bc05ee89ae", "comment": "Malware payload", "value": "4d5d7a98b37962cfb6d7ae402fda40b70b63b880b9f20f9d0569ce0986bc4e7a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700480789, "uuid": "b6dc80d5-d325-4f6f-8886-ae101772d8e0", "comment": "Malware payload", "value": "3f1ea228e39771c7f309b6eb482a66480757ec99", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700480789, "uuid": "7271a3d3-7740-4f11-909a-daffff0a2b66", "comment": "Malware payload", "value": "9e76210a8e88e1b690b03f5231409960f1b844cf11337e1fd7c51e05b012fd67bff5c1179df57bb133c796f4002b9650", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700480789, "uuid": "34572c34-6d4e-4f45-a0b0-627480d33d56", "value": "T1A4D4F10B982C62A1CDAD913D14B6BFD59C74BCA482FAFF315D98092CC55D69CC880E7E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700480789, "uuid": "1684a24f-7dc8-430f-b0c3-d81a4e018912", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700480789, "uuid": "2b09ce14-fde9-4ee9-91f7-e04c9606b059", "value": "12288:+j6kIbBwi8Z0BVyJYlQDBbABAabQ1MWzDGNGAU42+TDP1rMeOFioLxZ:8I1wVZVilQDqBA0QLGNGz+PexkUxZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700480789, "uuid": "bdc52801-ff8e-4be6-aeed-55a2defd9479", "value": 619816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700480789, "uuid": "517a1778-b2cf-4468-b9c9-8956a12b645e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700480789, "uuid": "c1ee2372-b548-4081-875c-669e7f325ea0", "value": "FACTURA_1_000019_PDF.EXE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ded660fd-8750-11ee-8907-42010a9c0042", "comment": "Malware payload (IRATA)", "timestamp": 1700449190, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700449190, "uuid": "e4ab05d8-18f5-44d1-9f8f-0a81bbe4a2f9", "comment": "Malware payload (IRATA)", "value": "013814a7b0cbe71c53959ceda800b850", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700449190, "uuid": "0a2c2fcd-ad33-4981-baac-08fefacee3a1", "comment": "Malware payload (IRATA)", "value": "4d702d443ed2aeac60ed77f6fe48c2b7356dee10b2e5e2691da85945d7e72688", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700449190, "uuid": "84913b19-53a5-4bce-9dfc-1abbb2e7ff8a", "comment": "Malware payload (IRATA)", "value": "2b283e770a10359dc1539b7bbd6cd2f26b6e2c6e", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700449190, "uuid": "ef31e610-eeea-4333-8db8-03b48733bc04", "comment": "Malware payload (IRATA)", "value": "f579b1a4705c212b95f0d73fda98dff6ecee965c6431ef5cbf3f95a84521ed27ac9675166af95fd2a485ea7324418852", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700449190, "uuid": "90de173e-76f5-4c9f-af7a-dfae7668f64a", "value": "T135D52343F762B917C8F6C3721238563A117A1D69CB43E746690A37BB64FBDD80B80AD4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700449190, "uuid": "e9be34c1-c76e-44b9-bac2-a13d8f5ab7c6", "value": "49152:+uE5/ZNyz1K+qh1/rmShy9+EBUbDNlGwt9L1lio+k2FGrQdCk:nQZN61K5y9xUbBZ/ngVbIk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700449190, "uuid": "13309bad-d724-4584-bc74-4522423347c7", "value": 2834439, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700449190, "uuid": "9b35a292-b61c-42e7-adb5-60d70112f930", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700449190, "uuid": "26e4f3d8-7da6-461b-834b-7f032ff77859", "value": "app.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e04dbb60-87bb-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700495148, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700495148, "uuid": "7c482e2b-3e14-4d74-bc3a-be643f4a1d0c", "comment": "Malware payload", "value": "c071299e1ba6c56f89ed021f525fc862", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700495148, "uuid": "e9e68bd6-3e28-4f56-b4b9-5c94d5ccdbd9", "comment": "Malware payload", "value": "4d89869a7e7a654cb5ffd4a30465332edfe478d0d00d841145ef082bee50e632", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700495148, "uuid": "761baebf-6ad3-4c88-85ce-dc5d7f903bc4", "comment": "Malware payload", "value": "a77eec03ccb9f7531d294215afe1394f3622bc66", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700495148, "uuid": "cd436e36-e29a-4d1f-b8e1-dfdf84a79730", "comment": "Malware payload", "value": "b01947b8fbdbc0d7b403d8829b1ada5a9edad07b1a9c57160b712163c19dd63664c68e6daf9da23563471c7c6a073e4c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700495148, "uuid": "1af624a9-6592-47ba-98a9-1dee9a31387a", "value": "T1EBE4128435150A66DCBD23B78A124B2257F6163E746EE3B0DDEAA4DCA750F02ED01F63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700495148, "uuid": "be6f1717-4746-47c8-9e13-c5475316862f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700495148, "uuid": "3a733981-3d13-49d8-bd68-51e10871da0c", "value": "12288:TeQXucvCeAeQseQWVmKDBBHvpKstZ5QReF1FIWJtr8XQrDwdzDwVUubu8d:Te4ucqeAeterLVBPpKeZ5QKIWjcQnMDt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700495148, "uuid": "ab750c98-81dc-48d5-8ac8-7705a103db3c", "value": 698368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700495148, "uuid": "b03f5814-3ce3-4273-bce2-38055d1e7b61", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700495148, "uuid": "e95bc647-3a84-4020-bf05-4e8f5c9edb9a", "value": "h6gKmCuKBVVMORv.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9f6efa5-87a4-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700485286, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700485286, "uuid": "dc8c71fe-43a6-46e2-b533-b4ee1d30d545", "comment": "Malware payload", "value": "509b68725e595b30fb2f38c8ea2cf9c4", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "cpl", "colour": "#36ED9E", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "pedll", "colour": "#17A6D9", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700485286, "uuid": "8ce83839-cfb4-4da6-a357-76101d4c5bd1", "comment": "Malware payload", "value": "4dae3b84eeb5e36c144f9fad2f2b06d9e82381cda6b1f043033cf3644f339558", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "cpl", "colour": "#36ED9E", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "pedll", "colour": "#17A6D9", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700485286, "uuid": "ed7dd28d-2cc2-4ea8-a4f8-9a83c9c9c955", "comment": "Malware payload", "value": "1aff17b87ff213c1a8f4c8cfe48782e636b6fb32", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "cpl", "colour": "#36ED9E", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "pedll", "colour": "#17A6D9", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700485286, "uuid": "95c20f98-deee-4714-869a-20c27df0accf", "comment": "Malware payload", "value": "1c0833ff92264775864d6dc224e971a69488ad621a719c27da0210e01252e4b8d30dd775f30df0329b13eb4dbe3a5966", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "cpl", "colour": "#36ED9E", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "pedll", "colour": "#17A6D9", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700485286, "uuid": "126bd2ec-4ca4-4be7-b11b-04930dc8727f", "value": "T1CF850203EF1B9EE9E53B9A7E8FA625468B4B36715709B2A728744107F4714008FF3729", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700485286, "uuid": "0549b66d-1e1b-4c57-a554-e6c8a86a8a12", "value": "ada2db691d15e230c727b763fa43aa8a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700485286, "uuid": "61693cf4-15c9-4304-8f4b-e8ec9e0fd726", "value": "24576:ejhyCJxQWOSUua9BgsID7yByhWjqcRE4ff6ySznNvWGYbjWfExlpaheDtg3UUag7:GfzUua9h9ERznNeXHWfExzmPLnvh6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700485286, "uuid": "c6ea9987-2dc6-407a-8377-190d0fce739a", "value": 1709568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700485286, "uuid": "2f5ff96e-61b2-4939-8753-7f1996773336", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700485286, "uuid": "cda3df15-ba60-48f7-822c-99040abd083e", "value": "config.cpl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05e6e845-87a5-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700485333, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700485333, "uuid": "10c7c5f5-f937-4c8c-a7a4-42d956b82322", "comment": "Malware payload", "value": "6f5d21f39b19710ac75e75c83fd979cb", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700485333, "uuid": "757bd4d0-d403-4c9c-aa96-2e8d11805617", "comment": "Malware payload", "value": "4dec34cce9bd330ba704371a77a14b742603c64e633b50ee4158ea55129e42f9", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700485333, "uuid": "e1547d53-a1bf-44ba-9801-5f3221a93d8f", "comment": "Malware payload", "value": "e928f581384dcd8dfeab2c63773fc560652e1794", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700485333, "uuid": "2e74bffc-9896-42f2-aa24-d8f0efc058e2", "comment": "Malware payload", "value": "d181ba44d696588d753e8bbffd974d6f1326bca63eb7a2c02eb48adc3f01bfadd56ddb970bacf80dbc86e7d4943d35bf", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700485333, "uuid": "2a3650ee-f827-4774-ba5d-a8ad36a6ccdf", "value": "T1BA56D021B9D0D077DD7306718EAEA22A667DBE70073951CB63D40F292EB05D3AA34763", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700485333, "uuid": "48ba724d-3d42-4e96-ab4a-4cc528258887", "value": "49152:J8JYy3JDtzkvlpYbBTKPiD+Mmp5T+w+X7gJhHcnsZ9Uwg5bGz:eJY2DtzrbtKPiD+MmTTf67gHlUB5b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700485333, "uuid": "3a6c2be6-d636-4747-a3d5-884c6b964ed3", "value": 6291968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700485333, "uuid": "88499a64-9ea9-4687-b0a7-066f82ccd07a", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700485333, "uuid": "69a2e562-95c4-436a-bd58-0576834c559c", "value": "rete.vhd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d8dadd6-877a-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700466904, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700466904, "uuid": "f2e3b4ca-d812-4967-afc6-e33f889c8844", "comment": "Malware payload", "value": "54fb24177629e37ccf5b1546b14573ce", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700466904, "uuid": "a1d45e40-642c-478a-8d80-2c7da3fa0010", "comment": "Malware payload", "value": "4e45a63cc1e24aca1d5bae6b9da91dd28cb9327b8e12ec11f025a5493ab110b6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700466904, "uuid": "9164e18c-09c5-4988-92e2-a88476b7ba01", "comment": "Malware payload", "value": "f7d9c6561094b84836abe407b8fa19901caaa28a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700466904, "uuid": "2742a3c3-cb7d-42e1-bbf8-8dc59f7ab51f", "comment": "Malware payload", "value": "46b19ff1490d997f9391c10d5918abb17ffbe9c2d2382343490e848a7260725224f5c4d09f52d79b55ab6a5271e34a25", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700466904, "uuid": "aaaf209b-36b4-40cb-9284-2ddf1db9fe73", "value": "T124F67CA1D1F1A95CF4DBC5768E20A3F462B278237B13E391DC14E525B42C6E78EC8663", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700466904, "uuid": "cf61b266-22f6-44fa-928a-ce57b61b95eb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700466904, "uuid": "4fdd7d46-7b1f-4dff-bbe1-dab33b01cecf", "value": "196608:asMxjxccyqMWVZ4pJhOvbh6lt++fpUPzdh:YXZ4rhOjh6lfIh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700466904, "uuid": "b99d2c85-aa34-4a8e-9db7-598b4f8c0db9", "value": 16441128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700466904, "uuid": "db00973b-8bd0-49ed-bc0f-34e8a70b5bc9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700466904, "uuid": "48e13999-41c5-49c5-a42b-a0d04db1cee4", "value": "1_DETALLE_DE_MOVIMIENTOS__2023_11_14__23_23_53_23.EXE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bfee8c02-87c2-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700498100, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700498100, "uuid": "18ad6b0c-69b7-4c28-8baf-ebfbb03742c5", "comment": "Malware payload", "value": "51acc3fc1860d19157be6904e7ca4858", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700498100, "uuid": "fbaf647c-c111-4e64-a0de-41cf6dce997d", "comment": "Malware payload", "value": "4fc7a527cd92275e3b8ae2cfb2e67d3f77760d29315755f02ce23dc455af27ed", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700498100, "uuid": "aac22d2d-daa5-4f07-859a-171658156256", "comment": "Malware payload", "value": "30e101aaababc4dbf8dd0e98533a98b133e248d1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700498100, "uuid": "59054068-8fef-4bda-b423-b39763dcb56f", "comment": "Malware payload", "value": "cfd3aa8ab96e3c782211234c55f4bc85f2f7db28b7311734d5b13c0a71f5b301da195ecbcbb7c8137920647cd113d625", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700498100, "uuid": "3192cd37-1e4e-4c84-91bb-8a2d8fde2170", "value": "T18214BE2277E1C432F22745744AB2C562DB37BC624B6596CF2BC42A7A8F212D1C7B9317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700498100, "uuid": "d31515d3-7d06-44a7-851b-9cfb66d7f8b0", "value": "befed62489b371bd700680a9a0ba2024", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700498100, "uuid": "751857c8-9d1f-497f-b0b7-e956d4e907b3", "value": "3072:Sbs7H7R0AY9iwOrdcbkN8wtbM2kSTG9X5UoJp+RPZ3FvEQj:xV0N9i/rv1Y2Yh5UoJ+PPE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700498100, "uuid": "ce26b550-d4e4-46a8-ac53-d038c930c704", "value": 205312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700498100, "uuid": "42ea2f62-f139-4060-a618-945e50e6469f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700498100, "uuid": "ebf6afe6-c85e-42d4-8003-6ff5bd38840e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df2f5fba-87c8-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700500730, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700500730, "uuid": "1ad54268-121f-4065-affe-511bc7bc5b88", "comment": "Malware payload", "value": "aca2e4b2524c6b3715b142550bee4fff", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700500730, "uuid": "e9fd45dc-1169-4fd4-abc4-c5c86327dfda", "comment": "Malware payload", "value": "4fd73538ae5ef59892a53753f0b094e4f71d1f29a432bc6f21aaabceb4137262", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700500730, "uuid": "c8f8a275-adfa-4b7a-b629-c9e8bc71cd81", "comment": "Malware payload", "value": "e3f2b859fca459874705d0ea767f93d67766cbef", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700500730, "uuid": "850008fb-d8a2-47be-8884-05468b78d7f7", "comment": "Malware payload", "value": "25220047c18ac5fdc0bd476a9e5aeab4974f5f810652d3bd69bca2cf47e8c190512b214304ba44ea41a1a1bcd90108c5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700500730, "uuid": "2628f8d9-3129-410c-80af-d6ff806ad630", "value": "T1CD559E71B502D037E1A101F5A67D9BA612A9BA301BAB08D7B3C05E3D95F2DC36235F27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700500730, "uuid": "e3d9ef3d-dc48-4329-8d74-26660e292c7c", "value": "7482a1595744a3c77ac9461f3f27a729", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700500730, "uuid": "7f5bf279-cfa8-4734-9f94-ba5c1da7cf5b", "value": "24576:NmmEs2wqfcRBxJCBEmAMpCOJMbgp2kvB1Pj5R+d3ThJgrU35Zln2i6:8dw/IyPxbgp2iB1Pju3TIrK5Zln2i6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700500730, "uuid": "fe327e3b-d4bc-4206-9fca-75d37415e3a4", "value": 1322471, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700500730, "uuid": "3454cd09-c064-49f5-934b-b8a178037625", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700500730, "uuid": "fb5ba804-d3fd-4012-9ed1-a51c10fecee2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee778881-878e-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700475845, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700475845, "uuid": "b51c21de-9648-41b1-a141-cb9bc3ed6551", "comment": "Malware payload", "value": "cd1dca03d17c0c04c8a06dcebba644ae", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700475845, "uuid": "b7ec6b9a-a3e5-4078-a14c-61fea6cd9668", "comment": "Malware payload", "value": "4fe234a3d249e386c5125d1ddbf0af2c033c605c19191fc0854b4c6a4b79aee8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700475845, "uuid": "b661ed4a-4a8b-43bb-9e35-aa1cda38c2b3", "comment": "Malware payload", "value": "87f5d381c903d72e32a0303069ed90bbc11b882c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700475845, "uuid": "14dea860-1844-412b-8a10-a47e16b8fdd5", "comment": "Malware payload", "value": "a7b502d542f69265076936cd2d1ebeeeed08c1bb86d405d3c3d5ae0541f6bac2ed2fe89a769d7462e22ad67fe54a040c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700475845, "uuid": "ff6e8a60-3c7e-4b28-9c77-c92ca4b30294", "value": "T1FA15F19BDDC14E75CEE1457C519BE068D3F022A9873A5E220DA370380B2DD16BFA5F68", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700475845, "uuid": "c1116e91-fa09-40a4-9379-4146694f1a2a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700475845, "uuid": "c142ae55-6258-417f-acca-bff44e8224cf", "value": "24576:9OhslvjwcGGaYZdpPQwWAbMg2z0mCXpjfVbI/hBn2y7:9T5pPF92z0mCZrVkZcy7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700475845, "uuid": "140cdb47-e10c-410c-90ec-e9514c5280cf", "value": 902144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700475845, "uuid": "e22fef53-c19e-4a02-ade5-1dfa98c6a0dc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700475845, "uuid": "5138d5cd-1b77-4a9e-a2e7-a2632dadd7fd", "value": "RFx DUE 24-11-2023 FIRST SOURCE-SINGAPORE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b219ac43-8790-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700476602, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700476602, "uuid": "cab074b9-b1a4-4db1-b691-598885956d72", "comment": "Malware payload", "value": "d65524f418cfe81efc963360ca5c2ca7", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IDAT loader", "colour": "#23D030", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700476602, "uuid": "44bac63f-2df3-40fe-9c2f-e02b9d45701e", "comment": "Malware payload", "value": "503f54c6c96e9d1d05206e97a343b58558f118eb36b4f44eeb0b28236d79dcd5", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IDAT loader", "colour": "#23D030", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700476602, "uuid": "a17c7b5a-c2c0-4a42-802a-1dc74072425e", "comment": "Malware payload", "value": "9a6d9837838a5b81d5aa1f563e23faf8cf35322b", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IDAT loader", "colour": "#23D030", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700476602, "uuid": "b8c2205c-e28c-45e1-8888-37fd2463837b", "comment": "Malware payload", "value": "cb69db31db13e53992fb6cc0fe4b9d46ffe2ea0e7acea25270c83ecee9bc6bc4177a80a08e76925bd7a3140a816b8c9b", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IDAT loader", "colour": "#23D030", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700476602, "uuid": "869c61ca-a87a-4eb7-91f0-f04760c301ec", "value": "T12A75C892EE4A75C8D2F700B1450DF3679DFAF2BD5FFC0AD970861658A3602D2D8127A2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700476602, "uuid": "5cada0d2-2e7d-4dcb-8d8f-dc0c1e937b3e", "value": "12288:m7K8QYXYBvXDGPDYOYx6JvrxzRjcZYyhr7yz40PVo3rV8/+BPg6D83WG:GoBGfYAJ8ZJ6wbV8/+YiwW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700476602, "uuid": "987bc2ed-8254-4f90-83f3-71ba9e9065ac", "value": 1552384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700476602, "uuid": "712fc9c3-ba93-4368-a969-e04f4c7935bd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700476602, "uuid": "eebfe59a-02cc-4f49-be90-85fa2bb66bf7", "value": "503f54c6c96e9d1d05206e97a343b58558f118eb36b4f44eeb0b28236d79dcd5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b399c0b5-87a0-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700483477, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700483477, "uuid": "3ea16b54-68fa-4964-816c-8ecf36bb3626", "comment": "Malware payload", "value": "c19399e9045071dc4ab0cb7f52f2f59e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700483477, "uuid": "a568c30d-3f52-46f2-ab05-ccc75ba1a51a", "comment": "Malware payload", "value": "51b487c92f5e52dc485cb8971b4725ed6a475e2ace51946e3cc113863067ef13", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700483477, "uuid": "82776e56-21c4-4f6e-a4cb-54e64652c8a7", "comment": "Malware payload", "value": "1cc4169e607c1dbed814b66aef383d764b7a6e13", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700483477, "uuid": "9f9c0f3d-a183-431b-acd5-b118640ffecb", "comment": "Malware payload", "value": "95fb0b40fe5598e30f1a8c05841105a4a67fcd5bfeb460b3bb35bf9d9cf9b5c84b07e3d9114d0cd6ffd7bbe849e96ef1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700483477, "uuid": "97404b8d-a1f2-44dd-869d-e9b383360087", "value": "T135D42244B9A4A623C08E45F8732E694417B4A9B6E593EBDD4CC1B0DB72F3FD11E22127", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700483477, "uuid": "64363bf0-59b2-4867-b945-1ed0a6594419", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700483477, "uuid": "803830fb-e5ce-4966-950c-78880496772c", "value": "12288:SMvCerm7itLTtlCJmBwHiKthWrbCurA+0Jlwhw/hKrGUMLT:jqermWltlCJmB6iShWGQ90A+hyQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700483477, "uuid": "45f8a09c-82e1-4273-9574-6daf4107b1cd", "value": 609280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700483477, "uuid": "38151fe0-19c8-4464-ae92-0026711d2fde", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700483477, "uuid": "3e03fe25-6b8c-420d-a451-5b7fe7c6aa6a", "value": "SecuriteInfo.com.W32.MSIL_Kryptik.DWR.gen.Eldorado.5366.1090", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef1541f0-87a4-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700485295, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700485295, "uuid": "c5b002ff-3de1-49ce-a1a2-24e2d14c2ba9", "comment": "Malware payload", "value": "3bed3fb03b12000c17c2f1fdfb6befe1", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700485295, "uuid": "a1ec0d24-72b9-496f-b37a-ec3fab46ab71", "comment": "Malware payload", "value": "522f6cd72ee97eb4d00c2b3ef4c93c4f3396f3c6c8f85dd58655a0edcd0b865d", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700485295, "uuid": "61eecfbf-fb36-44e7-b219-93349da15022", "comment": "Malware payload", "value": "36e60975b967f852f5ed31788e480336f5ce3ac3", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700485295, "uuid": "2ee4753f-9cdc-47d2-8014-7ea946904735", "comment": "Malware payload", "value": "acf7f6030a50d870efa97dccb7f70a3c52c867c2b58fc3ba670120cba7bf47030cc6b7b5dc9640a1480c2db0341c130c", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700485295, "uuid": "fdfe2455-5665-47df-865e-8cf4d85d03a2", "value": "T1F0D023090E4FC176C0424817D458BE5C9C0DB54416E1C45CD240E9874C510D1DC4D6F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700485295, "uuid": "35571112-03f1-4e78-848b-80b2dcfa44f2", "value": "6:HRYFJb7z9sZOA7xd0deo/Iyc1yc54vVG/4xHn:HRYFJHzFGx2UoQhy3VW4xH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700485295, "uuid": "c2760c50-3650-4de0-971b-7fd7340e063c", "value": 204, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700485295, "uuid": "1c698de3-0884-449e-a734-3b560e2ee259", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700485295, "uuid": "1596f293-76e5-4740-bb7a-34391de3da88", "value": "Agenzia url", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8dc9d887-879b-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700481266, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700481266, "uuid": "4a631608-b5ff-45b0-a716-bee93b68b92c", "comment": "Malware payload", "value": "3d2fc3836a767e534bd36c889287b7c9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700481266, "uuid": "dcb5cd16-fee7-4ef1-9d17-b27f6a4e54cc", "comment": "Malware payload", "value": "52b078c339720a09902be86de5e6875f2f31a8c24091453f96858b294f923924", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700481266, "uuid": "6b27b6d7-1403-44b6-8a6c-014b680622c1", "comment": "Malware payload", "value": "4c8b219253e73c20ad4d28b70194582ecfd71e28", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700481266, "uuid": "85669af3-0e76-4798-a1bb-2cc861b5127b", "comment": "Malware payload", "value": "ad502464aab75b82259ab50e73b6c16f40a0066aec4a67aacd3d84c7ab4fa8d1c7d5a34238a1d321e855b24bbabfa805", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700481266, "uuid": "155e625b-3ac6-4a20-b60f-37a80acb9e8f", "value": "T12D36497072227046D939343DCC19B1ECC95C6C17FF243A2F5466F96A7AFE28C1246AB6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700481266, "uuid": "db805109-004d-4c0f-9302-a17d4577e04c", "value": "57e98d9a5a72c8d7ad8fb7a6a58b3daf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700481266, "uuid": "ca7df395-aa46-4f00-a172-e5c79f622b8f", "value": "49152:NLpQwXodlK6q2AF1ybZ89Y2Ow17gRzvdb/wewEX/40T+b:NfDZ24e89H17gRzVjwewt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700481266, "uuid": "5fbabe9a-2e20-47df-960d-84a412fc43f4", "value": 5279488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700481266, "uuid": "7f8720cc-1835-4a15-bc6b-50e82921920f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700481266, "uuid": "bec30f59-24ad-4d73-a4d0-a2f480f09f0d", "value": "3d2fc3836a767e534bd36c889287b7c9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5cec4b6-87d1-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700504499, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700504499, "uuid": "def34d15-af99-4223-8dae-b9c1621c97cc", "comment": "Malware payload", "value": "69f23f97b1191972b5d15ef501bbe343", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700504499, "uuid": "62957a50-8142-47b0-ae57-85e3253ef214", "comment": "Malware payload", "value": "53a468e47ec24c4415be30db04c716e565486b76b92aebce9df7ab63825ee11f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700504499, "uuid": "064f9fbd-9671-4ed1-a7a7-116ded02eb2d", "comment": "Malware payload", "value": "d794d7c041cbb22bd9ada979081013b739779226", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700504499, "uuid": "fc4661dd-7684-4bda-86bb-d3a3c11c3d02", "comment": "Malware payload", "value": "6e06e13b0a71c4791a90a17b282776c0b903a5e08094bf67387063a44270f4fe280d9b9d3b3df52eabb9a52d66c1af5b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700504499, "uuid": "123793d8-ab9f-4961-a246-1c0e3cfab347", "value": "T179559E71B502D037E1A101F5A67D9BA612A9BA301BAB08D7B3C05E3D95F2DC36235F27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700504499, "uuid": "efed9158-c2a6-44f0-96f5-cf8e6583665e", "value": "7482a1595744a3c77ac9461f3f27a729", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700504499, "uuid": "2ffcf7c5-7013-4142-8284-b797cc656667", "value": "24576:NmmEs2wqfcRBxJCBEmAMpCOJMbgp2kvB1Pj5R+d3ThJgrU35Zln2i6:8dw/IyPxbgp2iB1Pju3TIrK5Zln2i6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700504499, "uuid": "a1292eef-97f1-4921-a842-5697e6fc20b9", "value": 1322481, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700504499, "uuid": "e6bfe809-8bd1-4086-bc65-c6b0fb54b792", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700504499, "uuid": "953626c6-cebd-4b2b-8c93-775a8e58d70c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d60ac836-87b8-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700493842, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700493842, "uuid": "813ba031-4977-4802-ba35-0205dcf0b6b1", "comment": "Malware payload", "value": "5e1b21fcb419a0b96a63f9b6a0440452", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700493842, "uuid": "c9e2c387-2e9f-4185-8af9-25ce5fe2f1e1", "comment": "Malware payload", "value": "562b46ab24e657a837f5bdf84cbe91190aac46722c2463183e6d680b836a03f0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700493842, "uuid": "fce9270c-cc5e-42a1-a50d-4d5826f846eb", "comment": "Malware payload", "value": "780ea45087f9fe32546806957e2c47a7a7a55a31", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700493842, "uuid": "b5223b72-6b3c-4cb1-a064-e1d96e8b5e32", "comment": "Malware payload", "value": "69782977840a810742a823950bd6ac3e0ddef9f0fa69006948b9d4f794e147ed28be65c335f0260cc24bd85cd6eed7df", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700493842, "uuid": "2b606ad8-ede1-47ca-b061-d9cc347130eb", "value": "T106D68C77914338E9E5A98CB4D11025426DAC388B5738A3C7BAC471F667BA7E48E3D730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700493842, "uuid": "3a90fc1b-6cb4-46bc-9cb6-877009b4e909", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQL:cqYUQuVDt0TZEM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700493842, "uuid": "e1e47338-b1b9-40eb-8041-362fce9b0d8e", "value": 13500416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700493842, "uuid": "82916f00-c9d7-445c-84f4-0ab25a80729b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700493842, "uuid": "7de8f012-18a1-4385-b508-d543be962005", "value": "562b46ab24e657a837f5bdf84cbe91190aac46722c2463183e6d680b836a03f0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "276adf7c-8771-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700463055, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700463055, "uuid": "492c9e99-6ada-4e0d-a6b6-0d0b7ef0b31b", "comment": "Malware payload", "value": "1d61c0d4ca7ef12ab709eb331e04a078", "object_relation": "md5", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700463055, "uuid": "a44829d4-dba9-4a02-a83b-88967e073b7f", "comment": "Malware payload", "value": "572d0ad191b4db1a3afa0ddaf8015f0147d257f20fabaebeefc1f45ac9e74dd6", "object_relation": "sha256", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700463055, "uuid": "0b2e0285-366a-42b3-83c2-8f06d15a2c26", "comment": "Malware payload", "value": "044712fb418643426d16f04558a366f9056f4ab2", "object_relation": "sha1", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700463055, "uuid": "3891456d-1740-44c9-9fed-2a8464b63798", "comment": "Malware payload", "value": "b0e34c3b41ff9d5311c70ecd2b0ff3f9543d6a49670b3e50fcaf173b6e573a4f60697adf5e791518337d17aefeea6bae", "object_relation": "sha3-384", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700463055, "uuid": "02c51912-8f73-4cb6-80a2-da5eb9b9ec2a", "value": "T1BBC423EEFF62A745EA6383BE8C535E4533038B65B2DCCD4A95E4A1F273240435CE0899", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700463055, "uuid": "bae0c944-935e-4a93-bf5c-86b9262d53b0", "value": "12288:tC6HMcDSGrJ5Hs0VNKEApvfS+4jpLkwyl2AB2U6IXNa44:syMMSCXssNKNXj4jtkw82AY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700463055, "uuid": "8c704067-f92e-406c-9a7a-ad3337f4e689", "value": 569367, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700463055, "uuid": "bf384e2c-a89c-43ac-aeef-12f073144370", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700463055, "uuid": "9995816f-a2b9-4199-9aed-a53eea848fd6", "value": "DHL - Invoices - Past Due.7z.001", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b2f59c7-8773-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1700463867, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700463867, "uuid": "fe72a0d4-529d-407d-bf7a-302deaa467ea", "comment": "Malware payload (AgentTesla)", "value": "ac8381672ad36961f2300d13db8e1754", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700463867, "uuid": "7824738e-d718-44fa-bea8-74cf207f5c03", "comment": "Malware payload (AgentTesla)", "value": "5965e49e180fcf64d8d3eda9f389d1e1a2f4399020d16172be15afcaabff061d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700463867, "uuid": "9446ffe9-e480-4698-af85-66aea33e9298", "comment": "Malware payload (AgentTesla)", "value": "c9b21ec1223e98fe2999d94c7c76e85aeb2897e1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700463867, "uuid": "22a48d76-e486-4a9c-8965-2421ee444723", "comment": "Malware payload (AgentTesla)", "value": "4e597844fdcc83dce96c9280a1e574b048c9d2268adb37327740c0ab2d74e1539d3759572aba2e81230cc6bef6872648", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700463867, "uuid": "d2efccaf-9794-4798-9aef-5bd7d78bc7e5", "value": "T101D4239A913B3CFA51E29B2D856982E201435ED1CC631EE13C06E7B53B3E25799BC1C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700463867, "uuid": "2bf7499c-3193-4189-8066-49e73927b003", "value": "12288:sDDHC9jMNpX3zaVYIMDR7tdtrC+RxkPox6chCSkTqee1Lhgswx:eC9jMnnzoYh7tdtrCoWwnpMAY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700463867, "uuid": "6589d494-4fdb-4edf-af5b-8b3dbfffb7d6", "value": 651066, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700463867, "uuid": "6f492243-d6bb-474b-9524-e6989ab75056", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700463867, "uuid": "6af10d90-a43e-4489-9542-416e15be02f1", "value": "NewOrder.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e20d40ed-87a6-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700486132, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700486132, "uuid": "0af2690e-2619-416a-a436-9822844e68a8", "comment": "Malware payload", "value": "ef9428407424cc578442727f6fe3bc5e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700486132, "uuid": "8e49986c-c1f7-4fe9-9042-315c034ab629", "comment": "Malware payload", "value": "5a4da54758f9a1a86f382cc9808e3f8e925376693555e9f834807ca352ca761c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700486132, "uuid": "63ebb6fd-becc-4494-bd3b-b5399fdec7ac", "comment": "Malware payload", "value": "ba6599fbc6a77b1973b1e1b58e2a9cb0655467c0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700486132, "uuid": "24a47f7e-e88e-4e4e-be5f-1d9f5319e276", "comment": "Malware payload", "value": "4f9117997a2cbee3125ebce7fa06e453138ff100d81251dad5e09aa81f184ccdfe6d40e6dee482280783b017a0bfdbf7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700486132, "uuid": "789076e2-6d76-4c64-926c-bd4615db8195", "value": "T124F633C503AC5B01C41D4AF65ABB298E6BF8C05E5612FBD7B790880A6492F3456FC7F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700486132, "uuid": "b348abe1-9890-4b96-85c5-82b390a1302c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700486132, "uuid": "16dc1a3f-11a5-407a-99d6-5bcb8e7620a0", "value": "393216:CaFCt7regPFRhBfvhIq4zvAkXxj5dbwUWs6QxF6iu:RFcTP7LidzIwHTWlQxoz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700486132, "uuid": "1cd8ecc5-0eee-4485-929f-921a0a133516", "value": 16009728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700486132, "uuid": "9186d31d-fb4c-4dcc-9697-3898ed575dba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700486132, "uuid": "9e68e116-42d0-404f-83e2-e20ad86bc75d", "value": "SecuriteInfo.com.Trojan.PackedNET.2523.3156.15821", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04e0fe13-874d-11ee-8907-42010a9c0042", "comment": "Malware payload (IRATA)", "timestamp": 1700447535, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700447535, "uuid": "c61530ad-fae4-4968-9cda-a137b3dd479c", "comment": "Malware payload (IRATA)", "value": "9c05241bbb97adcfe928b71aa750a842", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700447535, "uuid": "dbc7a065-41b8-4e3b-8c1d-f030fbc42c57", "comment": "Malware payload (IRATA)", "value": "5d2eacac07062b0fa317c0e09cabbbcedb06a57cb0a4f083f25c8c6225c06210", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700447535, "uuid": "b2ceb8c9-4c05-405e-b5af-d28304917db9", "comment": "Malware payload (IRATA)", "value": "56be2324fab24a015cd33ba3706b594baa6233a5", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700447535, "uuid": "98e5b69d-2d1a-4944-abdb-2968db798506", "comment": "Malware payload (IRATA)", "value": "7e0468b0d799d25a9bd119d8b60f93550e367411932e66e0b1c14c10a7c2e94a601c6e41bfae9b88472282ff6ca915ba", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700447535, "uuid": "f8efc799-c0cb-498d-b046-fcabac3b27d5", "value": "T194851243F3B5AD27C832D17224992B35211A4D24C946F78A295837BE64FBDEC0FC5AD8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700447535, "uuid": "63ad2fe9-8c72-4b4b-a903-45d679a67237", "value": "49152:hsFkk6EXLcoxsKrGHOnaDh3BxCCFje+4L/qHRF2:YkkBXgot6Oqh33rhe+QH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700447535, "uuid": "ef9c05f7-d968-44b4-80ed-229a61253b04", "value": 1776691, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700447535, "uuid": "d3d3baae-b83c-4786-8b88-856182002f66", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700447535, "uuid": "28eb00f0-fa4d-4be6-baf3-9b7faa858798", "value": "saham.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc492b27-8778-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700466419, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700466419, "uuid": "c64ffd9a-9c52-4f02-ace8-0ccda51ed0bb", "comment": "Malware payload", "value": "28bff499f4546df1f6495a3e07486e2e", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700466419, "uuid": "819264d2-3a86-43cf-8e50-173964aa900f", "comment": "Malware payload", "value": "5d50717f5a866456842ee76543682f0f500619c4f7b12c548be9ea1c0e9c981b", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700466419, "uuid": "c4d2f326-9184-4e6f-8c50-0dce4f5a58ee", "comment": "Malware payload", "value": "42c883c372dbf2699b08b23a404d7962849a5406", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700466419, "uuid": "51528f67-9435-4bc6-bf34-cd004d809d2c", "comment": "Malware payload", "value": "f32f960d03e9ac225e9801b94a9e96ff11c8a94e39099c62c1d43b897d1cf35bb966762ac4280ca6ab678eeae4a43ff5", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700466419, "uuid": "820c95ed-4e43-4e40-a693-b2efed8c06f3", "value": "T176F4234CB6E30DEDF3699672D3CC188CC7B6867D590308D5F82638EA8563637A098D39", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700466419, "uuid": "4a01719d-db11-4f10-bce5-ef864870893c", "value": "12288:i2/9WButnQsMAeA3IWhgSnRUq1N+8OKV/K7v26LH3I04jvplhVfDDPaO3:i2l1AAtFpRH1rOKFv6LXI0Clfh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700466419, "uuid": "c585d73a-a78c-47fe-93e6-cfc0b378989f", "value": 755415, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700466419, "uuid": "55668fc8-e2d1-435b-9414-27da1f4bf046", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700466419, "uuid": "8a338e66-0639-42e0-a118-95381c1709ee", "value": "Purchase Order.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7516d2cb-8760-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1700455884, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700455884, "uuid": "01d2f25d-7e46-415b-85bb-6e6434e0ca99", "comment": "Malware payload (Mirai)", "value": "6aabdebabae4fa8862e023262efa0def", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700455884, "uuid": "518aa656-9c1c-4171-a301-01e98e61e454", "comment": "Malware payload (Mirai)", "value": "5e4ef858ff7f0bd581d90ce9fe0e242beae654dfa22c0a7feb322dd1162c147c", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700455884, "uuid": "b6a53e87-15d9-4275-9522-ac0ecbe29c68", "comment": "Malware payload (Mirai)", "value": "5c0b7630fe689881f2b3fd9596339bbb7700eefb", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700455884, "uuid": "39efc76f-5f74-4732-bccd-952109c06629", "comment": "Malware payload (Mirai)", "value": "8a6025bd5695c755aadb164f620951fc856039abe3398ebaf8f391927e76da4c473290150f4816d49be49577ebb505c9", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700455884, "uuid": "a2e08cdd-4063-4bfe-92cd-ad51352b117d", "value": "T1FDD33A17B5C180FDC4DAC5B44F9EF536DD32B1AC1238B16B2BD4AA221E4AE315F1DA50", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700455884, "uuid": "814d583d-0a38-4160-8e7a-b29858219d98", "value": "3072:tGtwnNiaOjU+wFKPT9OSQ7AOaogjV2iZlBWCgGiA3QPdL:tGtwnNiaOjU+auLyW3QPd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700455884, "uuid": "5fd0f1b4-1cbf-4b62-a6ac-dc6692de09c3", "value": 139576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700455884, "uuid": "3aca3724-5b18-4013-a5e5-81cd3893759b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700455884, "uuid": "2f8303a8-7068-41f5-9c1b-0559c90fd8eb", "value": "top1hbt.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c8e19ce-8773-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1700464057, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700464057, "uuid": "944fc4e9-c384-46c8-9800-86bb21fd0dba", "comment": "Malware payload (AgentTesla)", "value": "1076e41504ec8ca35f05cc87a5f61de8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700464057, "uuid": "1c439afc-7b2f-41d0-9105-9fb0fb37ba80", "comment": "Malware payload (AgentTesla)", "value": "5ea3537ff32c00d10459d4cc8b3c1038e36e092f644e1baf4449abcdacde9bac", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700464057, "uuid": "4508eff4-38bd-4960-b7cd-cb1cf8b547fa", "comment": "Malware payload (AgentTesla)", "value": "8f951e36e9d37e550bfad795aacd5033f56373eb", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700464057, "uuid": "dc3ed09f-782b-4246-9231-79f37c292876", "comment": "Malware payload (AgentTesla)", "value": "9d73b59611d2006edfe2e06215c51d92c890c821056c8281df563c0ad826cf87d3a299b24214ce8747b45a698eee4313", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700464057, "uuid": "8cb0fa3e-6a2c-443e-9158-892f07fd7886", "value": "T1BAE4233EA1FFAC7B4DF759190DF0E676981E6B0928D35E23F42EAF10E6D82243941419", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700464057, "uuid": "a500f1b5-7a77-43e7-9a1d-33d822339661", "value": "12288:dGCJ6+rVE67FaeGC+YpHIpXB7ICj/2gvaQ40o0pTIkBiMQRi5Zh1TKTJ5knloYIH:dD6AVE6j1NYx5aQ4cpMkBXQw5ZL2WIH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700464057, "uuid": "4c76d63d-0c65-412e-8ef4-694b08f55888", "value": 660019, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700464057, "uuid": "8c3a79b5-42b9-4ef3-a523-5bf3ab201460", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700464057, "uuid": "992680b1-3fc4-4920-9ac1-18fa5e5bfc1d", "value": "Invoice Ningbo & Delivery Note Ningbo.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bea1b17c-8766-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1700458584, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700458584, "uuid": "976e3a3f-66e1-49c0-924d-07b268ef6d33", "comment": "Malware payload (Mirai)", "value": "0637974e407f30a9a698b20a2704080c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700458584, "uuid": "f4baf21a-62b6-44bc-9dd4-1a24b0b4d29f", "comment": "Malware payload (Mirai)", "value": "5ed4b817f465dcd260f1743e72a906487247268d86e6c83ccdb8be253ddf4d0e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700458584, "uuid": "f9d6db21-9600-4417-bc28-f8af477b6367", "comment": "Malware payload (Mirai)", "value": "1d087ac929d74fc6385dc97aabadf9910bf6c034", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700458584, "uuid": "efcab255-7ab2-4e82-af91-5f59a9036bc9", "comment": "Malware payload (Mirai)", "value": "735be390e0b574f6fc79563f034838522fc176a1a6b64944e788c3b84628a88cd7f19b3f046985280c226d3e5dd61985", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700458584, "uuid": "5d9748d8-e5ed-4f99-b694-b5a11ddb6709", "value": "T1A7B34A77C8296FA8C259D5B4B0B09F792B53A58182471FBE54B2C3B64083DCDF505BB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700458584, "uuid": "fd4a1d74-1f71-456e-9360-c0145104082f", "value": "1536:2aVTHW/6eqjmPq9jHFGEWCRPKBKFnLblvCifzQVW9kXxeUwr/zp:2qWBS9jlDWMSBOlvC2sWqXxQrbp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700458584, "uuid": "3edb6987-6093-4e56-9814-3ee8fadc4227", "value": 117568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700458584, "uuid": "8e8f78c2-a634-47d7-97ff-4a01ce3a1e9d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700458584, "uuid": "c1b43e7e-3c2c-4aec-a606-c991d0adc881", "value": "0637974e407f30a9a698b20a2704080c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6cbec36d-8773-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1700464031, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700464031, "uuid": "b47e695a-28eb-46bc-95c5-d87193d5b25c", "comment": "Malware payload (Formbook)", "value": "7bbc8c29e978d1f162dc3f51ea9b3b13", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700464031, "uuid": "96d2d8bb-6535-4469-ae64-34b4915f22d7", "comment": "Malware payload (Formbook)", "value": "5f6c56b507816fd602186a2a9d60a2757b2e40e042f2beabb452ddca228804fa", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700464031, "uuid": "3821472e-23b5-4ca3-8cc6-84a21a942f8e", "comment": "Malware payload (Formbook)", "value": "5e0235834b735060aefd98e7c033d0d9bd459b45", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700464031, "uuid": "346cd289-9055-4169-b3a6-d82229f56708", "comment": "Malware payload (Formbook)", "value": "d871300796d7f09e0694124bb4965dd391c16e2f00893bc72ddc6d1a66229907f8a368d95ba5ba35209af583852bf8ea", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700464031, "uuid": "683a552c-3bd9-426d-9e66-49c398a31156", "value": "T19EC423FD292DD78F19ADFBE6282828BC27CD71512F566A50444CB7394362201B6CBB7C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700464031, "uuid": "ae7a21d3-7338-45c6-b2c9-7d1b45685c9b", "value": "12288:qa+u7hJh0SGEMJy83y2G2zmQU3KmDDl45EAoc+8alnLYejq0v2Is/vT:qQ7XySGEMJy8i29u45EAo6aLPBs/7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700464031, "uuid": "f4226cf1-4175-403d-b5a5-0b8fd837463d", "value": 565393, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700464031, "uuid": "694acb8e-6911-4c6b-a9b9-26ecc0e3deb2", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700464031, "uuid": "27cb6ea0-8910-40a6-8e11-8ec0025040f1", "value": "#PO-NX - LI-13-11-20.exe.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b59aaef-8777-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1700465800, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700465800, "uuid": "48de04f2-4216-4933-b75c-982b4327979c", "comment": "Malware payload (AgentTesla)", "value": "a0830ddbf43c39749eecde362c59d185", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700465800, "uuid": "1dcd7216-f953-461e-90ff-5faba557fcb8", "comment": "Malware payload (AgentTesla)", "value": "5fbe3b1e17b23ca0228f512a949f236a2d29548fb673e51caa2d7711ce761420", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700465800, "uuid": "a7e0c5fa-566a-40fb-a49c-84971b0e5396", "comment": "Malware payload (AgentTesla)", "value": "170806e772dd4197e02cc2f84b71cdf14bab625a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700465800, "uuid": "10f7aa23-5939-4f5d-8d69-2c5aab978a62", "comment": "Malware payload (AgentTesla)", "value": "f5bc931312d333e8625e85444b5829ddb1c5b8d62ae6a1fcce8bed4d2f2915444ec3c03e3663b438dc9ad877f031c605", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700465800, "uuid": "72a78fd6-c2f6-432c-902c-99d4d6090308", "value": "T13F05DFAC72517DDFC86BC475C9A82C64EA217566931BD207A01B01EDAB0EAE7CF111F3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700465800, "uuid": "6b7ab4be-7c3c-4aa4-91f8-0bb1974d8d71", "value": "12288:kz8J0ZQAFnS2Ejjy1U7q76xUlV8kBqjHLfGh1aGrUwONvueg2HepOxbcVbpPk3aX:kz8JxqS2EiKU6xy8qq3f41aREewkbC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700465800, "uuid": "2f6f4586-5f2a-464b-92b2-4429fa4a76ca", "value": 819200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700465800, "uuid": "36775e4d-d9a5-42de-80a9-586f7fc090a7", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700465800, "uuid": "ce65c7a3-644d-4f56-a545-e025deca7527", "value": "Data Sheet.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5f5cb90-879b-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1700481306, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700481306, "uuid": "2d8c3b6f-8e7d-49de-982a-1cbfd80755ea", "comment": "Malware payload (Formbook)", "value": "78e63749df575018669716af77ba200d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700481306, "uuid": "eb3d5bc5-68c3-4487-b7c1-da94e0f993ad", "comment": "Malware payload (Formbook)", "value": "6110f35fcf87222bf7479e1f7981653b3d6e378883e40c0f4f773485c4f195c9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700481306, "uuid": "441bd15a-4d5d-4796-b374-ebb0e2fb3f79", "comment": "Malware payload (Formbook)", "value": "d40b7d63863ff3cf5544da6ec717c66da68ee5a0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700481306, "uuid": "e3e4eceb-3f59-4bec-94a5-23e7955972f2", "comment": "Malware payload (Formbook)", "value": "7ae858d340dfdb2a6fd6d88165882fff3baff934f04f9ffce4386d354982445701f623c7a1a645b0762534e80de8fe7e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700481306, "uuid": "27cdd80e-19a1-42b3-b579-d37723a58d56", "value": "T1A3741285AFEA6A73CC0642704876CD20DE744D098E1195D75380FEBBBCB51E6A94E3B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700481306, "uuid": "246fe352-ebbc-4645-9d9a-d6274e3c1eda", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700481306, "uuid": "f9057b5c-2d02-4e34-9b46-7c8a23f6a83d", "value": "6144:3BlL/SM3mmaBle5TaK2q5Ngm6uIZ1yHKvQBIxTKgS/92Is6I+NcCQhqtzmVKVbsD:x8EjJao6uIZ4AmgqB3N6mWUsRkoH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700481306, "uuid": "735a06cd-4754-440b-bf49-4b8bc251b701", "value": 365804, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700481306, "uuid": "1949cdaf-eec7-400c-91c0-74d8d1074e5d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700481306, "uuid": "376fa936-da75-4884-a573-b3a1044d1ead", "value": "PWS-021140.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6112e8f5-8773-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700464011, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700464011, "uuid": "3e874652-5a7e-45f2-88d0-63a52af6bb1d", "comment": "Malware payload", "value": "5c9e31dc2dc9d86c48420b611f698f45", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700464011, "uuid": "f45d981e-522c-4492-a580-eee3e93b28f1", "comment": "Malware payload", "value": "6331e35db27a4eaa888a724433ff5e8c6081a7c8910fbbc2bb5f97e3e5fc28d4", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700464011, "uuid": "1d564b40-6a37-4309-ba0e-2224bc22cc03", "comment": "Malware payload", "value": "fe01fe5eb4751de4e02f60b877005cd4181a4207", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700464011, "uuid": "4eb5d1e0-deb1-4664-b373-79863d5d2dae", "comment": "Malware payload", "value": "0401069b681a864a10ecd66cce2ad618ceacf2e81728597c9f1c952de2c0e1ce66e452b28b2458ddd8f2e6c7a8613f41", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700464011, "uuid": "b7817b6d-ce3c-4bb5-8d72-1df9086c4996", "value": "T198A423607A92176A2DF9D06C57B3CF09633646D9C8CD8DD70E1ECA8D924C29953BB833", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700464011, "uuid": "691a99f1-c5c2-4b15-bab6-03fa1f2bd263", "value": "6144:vQwGbCnF9Go3UEkTUiwo0tRo/n0YnymGx3iLKbMbUNmA8tDX8J7NdawtP20:YxmXGo34T/wo0t3DmGM2HNGc7NNtP20", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700464011, "uuid": "dee75d59-d280-4695-ab7d-d5704559b836", "value": 450172, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700464011, "uuid": "bedf93ca-e13a-4712-9849-bd66adad6bee", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700464011, "uuid": "dbbcdfb2-bb3e-4c57-8e15-f467f9832899", "value": "hesaphareketi-01.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3022127b-8761-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700456198, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700456198, "uuid": "82f76167-a169-4dd9-88f4-12338d5f9aa3", "comment": "Malware payload", "value": "edd73e79cb7b8abe0f569844931f4fdb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700456198, "uuid": "8f4c5bc9-6da9-4244-b837-744da0372bc5", "comment": "Malware payload", "value": "63863aca0274a40e87b3c1e1803cfd971b8b7e3d3205c24115b518501f410bb3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700456198, "uuid": "80a100eb-ac00-4f14-aecb-1bbfbb98b939", "comment": "Malware payload", "value": "b8fda7acc76becd9d5f5d9e759c4bd7eb235ec27", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700456198, "uuid": "151d7703-0795-4e64-9a2e-820de2f6685e", "comment": "Malware payload", "value": "158a834dc8487cf05fd7cc8db564d8ad49390c4bc251ccc8cfa1fa4c68b3d6abf180fc97c69451f8283ce0ba148cafe2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700456198, "uuid": "4bcdfe0c-fee4-4487-af0b-472f4f87dc21", "value": "T1102802538BD841F22616DBE373EE1212558647A8A74DBD1E2EBF03C5987BC794F0E218", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700456198, "uuid": "92164390-d7ed-4012-84d4-a8cc26ab2c11", "value": "a9c887a4f18a3fede2cc29ceea138ed3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700456198, "uuid": "c041904b-743a-47ed-bc1c-c95fe8462aea", "value": "1572864:zxq6+uftcjoGI7iGT/69dpTKdVGTNeNUBg+a79mAIjiGkerqXmEE:Nq6JftcOXTGTK3GTINUBgJVerd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700456198, "uuid": "c2285b87-09e8-49b5-b2b6-74aed1b88ce8", "value": 97138176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700456198, "uuid": "cf3651f4-f050-49d3-ba93-5a759e1fad66", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700456198, "uuid": "da346bf2-e209-44f5-9ef7-75dd246db7e3", "value": "ICLOUDSTEALER.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1308d61-8776-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700465407, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700465407, "uuid": "d868b128-6c54-43b7-95ef-8d4c5e31bd38", "comment": "Malware payload", "value": "f6886fc47bdbcd4f4059254792520eb0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700465407, "uuid": "cd549583-3550-4567-9389-6e6533431e9e", "comment": "Malware payload", "value": "63c922ff25938c4045f570b33308deb97a801ac1dc16f572071337f3fcb96075", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700465407, "uuid": "8af0f6dd-9bb5-46a4-9b7f-468acb83c57d", "comment": "Malware payload", "value": "af68dba3b15aab781b58b6e811a6751146c19e4b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700465407, "uuid": "1f1e2923-0a43-4cb8-ba58-f91cbf273844", "comment": "Malware payload", "value": "f92484ccee1f25a77641f72ef0b19a037187518c04978f9da1e9cf5eebde6b2a3abd4a1fff2e384a5db8daad8f9dbd94", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700465407, "uuid": "003af7cd-85ef-4548-b16e-d4fa404d9d8f", "value": "T1A1B402D13BD2D476C037CD33C7A3AEE29E241A862ED8DED3560067072B37E45994992B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700465407, "uuid": "8f4c7e10-ab51-4aee-aa67-18ba7f23eba6", "value": "1f23f452093b5c1ff091a2f9fb4fa3e9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700465407, "uuid": "9c8a6a7c-0e18-4825-a437-ba9cb28fce1b", "value": "12288:/ImEcvtDAQ6MZFQp7NPFyLNrw5Lp2b98p0u:/pVvNJ6MZFKNtyLNraLp2JG0u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700465407, "uuid": "07438474-90b3-4860-befd-2778054156fd", "value": 537384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700465407, "uuid": "f5040e0e-8a4e-4fd1-9925-18c1962fa594", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700465407, "uuid": "de0e61c9-be7c-4a70-a9c7-d922e16537a5", "value": "MD7100380.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ce4b4a0-8779-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1700466447, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700466447, "uuid": "007c5db7-96a1-4d95-b638-193fe1fff748", "comment": "Malware payload (AgentTesla)", "value": "5438ade85fb9fc14f540ef18835ca7c5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700466447, "uuid": "22f2b237-5eee-4c2b-b823-ae9967e04db5", "comment": "Malware payload (AgentTesla)", "value": "641493f5f277b98834a500161fe950202f4c1770334495379e6f4b5aec76336a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700466447, "uuid": "c494e8fb-c5e4-4047-bbe9-d4490ef3f2d7", "comment": "Malware payload (AgentTesla)", "value": "45b3433f03f6e1c2c81898601549f063da9ee12c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700466447, "uuid": "dfa416ed-a59a-4a2b-a5b8-42a18cb6c1b7", "comment": "Malware payload (AgentTesla)", "value": "1b8356c7bc5b154fdbeec0d3c7360a87f77fefa3850a59d97abcb9e298c304e9af3ea3cc3f72f683818ec84042291ac5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700466447, "uuid": "c37d5591-9e84-41ea-a4be-df205d8d1560", "value": "T1C7D422453BD8AB32F2796BBB602921905378725F76B0E21C0DD621DB476AF456382B33", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700466447, "uuid": "7d231e8d-26e8-4cac-b826-8f47308be0e4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700466447, "uuid": "1476db0c-edd5-4614-bd5f-18d89f0b8cb5", "value": "12288:6cAFnSKaqu6TWFrip6MXHNalARaXgtBHfl6uKLYZYq3:dqSKaqu6TCiQMXHNal0aXgPfl9eYZYq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700466447, "uuid": "485d948c-c872-482f-8d5b-ebfda55eb238", "value": 623104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700466447, "uuid": "2d894278-203d-4f61-9a09-b39523b6b2ca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700466447, "uuid": "0047fa79-396a-465e-bac4-cd45f81f101d", "value": "SOA_settlement_details_transfer_invoice_014_november_2023.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "496a5598-8739-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700439060, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700439060, "uuid": "d9f95da8-a15e-44dd-a490-04ca6edcd853", "comment": "Malware payload", "value": "92a510e8b50d8ea70766e0edd3fa664e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700439060, "uuid": "ef33c0b5-edc8-404b-999a-f4a06b342fa2", "comment": "Malware payload", "value": "6421fe243c23eb13a6de49f90b5ab1584bb58d5642a996ca1e709e493e23cd2e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700439060, "uuid": "dc35c4f7-1ef9-43c6-8c14-b5f2bd1cf3ec", "comment": "Malware payload", "value": "4149757234d316da27d2d67cd3d41007eb0a43d6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700439060, "uuid": "1ac80415-32fc-4072-ae94-92a434d4e1ef", "comment": "Malware payload", "value": "5e0ac5ac43c7f2fef02f444a1faeea88f194054f22f9fa7d4deb079c45bbaf1ea9a5c6af136faa03405da62a88864843", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700439060, "uuid": "24714cd9-1991-464b-83e6-ba2cc8d2e4af", "value": "T10D559E71B502D037E1A101F5A67D9BA612A9BA301BAB08D7B3C05E3D95F2DC36235F27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700439060, "uuid": "3e8fb9c8-f558-4670-aba6-41ce9c1dd6df", "value": "7482a1595744a3c77ac9461f3f27a729", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700439060, "uuid": "6ec35533-7a7a-4456-96f8-ba8670f34c86", "value": "24576:NmmEs2wqfcRBxJCBEmAMpCOJMbgp2kvB1Pj5R+d3ThJgrU35Zln2i6:8dw/IyPxbgp2iB1Pju3TIrK5Zln2i6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700439060, "uuid": "c9b2435c-87d8-4431-8c95-ac086e1d4dd7", "value": 1322317, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700439060, "uuid": "c9e18d4d-7a60-455e-bf60-2ada202fadea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700439060, "uuid": "50930943-6035-4f44-994f-e2bae8a90f03", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e4aff6b-8777-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700465590, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700465590, "uuid": "ee6f2b53-1d08-4da0-bf9b-1285f497b01c", "comment": "Malware payload", "value": "692bbe7f318bda61afe85888238d0611", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700465590, "uuid": "ff7091c8-903d-47bb-a0a5-dbfa35fa55af", "comment": "Malware payload", "value": "6612f21733fc86fbca18572263f4651aa9ddd835f3cfd94547e58c8ff58cb1f2", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700465590, "uuid": "8c7ad937-e42e-40e7-8930-5e04748e0bcd", "comment": "Malware payload", "value": "1ade6e79c753a34232fa066e879387929345486b", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700465590, "uuid": "619b03db-1203-49e3-bfc8-bf6ad86a588f", "comment": "Malware payload", "value": "46caef183ac25f89e33da2eea32f4e445e7718394caf67d394821104ed7c2f8892467b599c59720246cbca963093928c", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700465590, "uuid": "5495e899-7a4c-44f3-85ca-b99b3c732221", "value": "T1C4737DA2DE6515094D4B37A9DC815C86C5BDD06A6A22042AFFDD43CEA10B89CD3FDF0D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700465590, "uuid": "fa032ef6-848b-4c1f-bc5c-b9e6e241499c", "value": "1536:rR97c+YeOD4aoviKwQqRAF7/95ZVxNsJQFMBKy7aGvb:rRGVgiKwFRARfZVxNsSFMZaGvb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700465590, "uuid": "10f1cd66-2276-4261-8b7e-9acd1f613095", "value": 76561, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700465590, "uuid": "f48849f4-ff23-407c-8f7e-dd33a1b1b54c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700465590, "uuid": "645eeee2-3c10-4600-84da-3cda8797b4fd", "value": "cerere de pret 11_13_2023 N654566544664567544689.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "709b1771-8751-11ee-8907-42010a9c0042", "comment": "Malware payload (IRATA)", "timestamp": 1700449434, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700449434, "uuid": "49e7b647-f65b-4295-85b8-8caf528727b4", "comment": "Malware payload (IRATA)", "value": "37db4fb67e3dec1f7798547dbfa7335c", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700449434, "uuid": "6fab5633-22c8-43f9-8492-3ffdea82005a", "comment": "Malware payload (IRATA)", "value": "66b2be1da3c7546f6356f0017c07bbe9733a42c4ed06ada7c61a75d7200cb02e", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700449434, "uuid": "f0eb0b45-fb5e-4514-9836-ee0285fb0896", "comment": "Malware payload (IRATA)", "value": "9adec70a22aab03984592a747cf2bafc623fe9b4", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700449434, "uuid": "86e914b6-4c47-47ad-bd16-4958b7aeb9ce", "comment": "Malware payload (IRATA)", "value": "e8a82eca20481733756b536f4ef16f8544cb074e524608dfac028e1aed6a72634cabc1ed521f607577bcd9568e8207a3", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700449434, "uuid": "f72c6654-dd6b-4a7e-9e90-195e0aaea5e6", "value": "T1ECD52393F376A82BC8F6C33222B4163A147A0D258783E745294977FE28FBCE84B455D5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700449434, "uuid": "4d1d2c3f-3dbc-4a79-836b-150dedb95d10", "value": "49152:Ry/JhovnmoH4ix8ZtAtoRBH9HjZys7EWZ6mtieKJ35+JEW/BYEbb6vYqo9s6prWO:qEeoH4LDAtiB9MRWZb7o35/iBYEbbKYT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700449434, "uuid": "a45544b1-15f2-4e4a-a04d-1b9dbeb707e1", "value": 2814020, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700449434, "uuid": "09a98ac8-d1c1-4f6f-b76b-100bdcf76df3", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700449434, "uuid": "5e310c0b-ff04-444e-a80a-359aac0f9c09", "value": "app.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd283fae-8762-11ee-8907-42010a9c0042", "comment": "Malware payload (RemcosRAT)", "timestamp": 1700456864, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700456864, "uuid": "ac681608-dbcd-41fd-bf18-2f0c447e546c", "comment": "Malware payload (RemcosRAT)", "value": "8a8bded3a03d8c656fe52e8a49594729", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700456864, "uuid": "f1552455-727b-4a21-a419-4fce3d4871ce", "comment": "Malware payload (RemcosRAT)", "value": "66dd4b98d3e93fd0952848a182fefce3a962e41c1121d2bf32fd92b27bd794bf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700456864, "uuid": "3940487a-1b19-430f-a83b-2adf0bc87dd9", "comment": "Malware payload (RemcosRAT)", "value": "af759a533b2b7d6925a04882b101f361445b95fa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700456864, "uuid": "126e3d7c-3df7-4653-a93a-c5decd342e7e", "comment": "Malware payload (RemcosRAT)", "value": "ac5eaa9d14a4fae17eddfad61b2151e827f33db17d69a4e9eb5ba26951adcf0ab1a3d7669bf81ac9afe8d87338fb5ed5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700456864, "uuid": "1697af8c-d9ee-4213-a58b-d7191b0abf29", "value": "T1433412641721E95AF0E0D0BCDA44E9F25AA97C602D8B6E0D43ECFF17F917002E78E556", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700456864, "uuid": "0d394cfe-3cfa-48bd-977a-58c278ecd5fd", "value": "bc4f8e98d1041d53dd63bfb91ed10d0a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700456864, "uuid": "3250935b-cfff-4496-8a1a-8c019974ca3f", "value": "3072:bOSI2I7txG68nYrugMZJMfsciIpuKNtrUQlAK3qSjYPS+IAXb3Ixi5eFrgurIlNq:6vG68YrvM80ypnjAedo3qiGUY2ChzI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700456864, "uuid": "5a3eb44c-575e-460e-bf39-8cf1fd619014", "value": 238592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700456864, "uuid": "e4f29db0-b576-467a-8f5d-9d1b272996a9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700456864, "uuid": "c3dd0264-f25e-42eb-9a61-88118ddf6719", "value": "bREJ.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61714432-87e6-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700513404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700513404, "uuid": "7957fc85-75b7-4518-85cd-54b6a26a9877", "comment": "Malware payload", "value": "79d8b7a72bc38279ee9723bd2e2afa82", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700513404, "uuid": "8ccb4c0d-76b0-4a32-8184-d985c87e5035", "comment": "Malware payload", "value": "6ac64635b08f309fbcd4f9c719d6e96d0da423bf52a0eb39515b95897567c105", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700513404, "uuid": "72e7591a-c025-4e31-b574-8dafa13d9966", "comment": "Malware payload", "value": "bcf066b44909810cc5bb13eaf6b95eb9614def47", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700513404, "uuid": "ebaaf454-4f74-4f40-9371-d143192b604d", "comment": "Malware payload", "value": "b1b8bc97021b8c76325afb6481ba59a05a053b30dd9cb31500e2360512e031694e8449684e8228c0804ae477f7e724e5", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700513404, "uuid": "8f106e29-1a8e-483f-b962-b5689c799553", "value": "T1BC435BC8AA03D8F4DC09493115B7F7729672F47A1224EA87DB96DE36BC42F12B50629C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700513404, "uuid": "2fdbcdf2-8687-40f8-ae6c-bcbac0c782e5", "value": "1536:nY/bqC23d6NJ+ObqoGQof2wVzNicotRF/26OOvkBSQyQR:nYTJ23d6NQ/o3oOFcotRJxhvOb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700513404, "uuid": "84ad5093-5729-4144-a9f1-d6a8be9a0bfd", "value": 57988, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700513404, "uuid": "0ffacc47-f792-47c0-b8ff-6717c2f7dcf5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700513404, "uuid": "91edf2a6-aa5d-497b-8d52-339de90a88c9", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f81da56-8779-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700466532, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700466532, "uuid": "aa5a96b2-24f7-4ae5-ba36-eac14328011f", "comment": "Malware payload", "value": "c0015622ab591f456cbf80076062cb8b", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700466532, "uuid": "af79c09f-749c-4818-99a1-9fdf8bcf24f4", "comment": "Malware payload", "value": "6ad1cf987025baab538aafa7ccb1b21c9aecb3bd8d1bf239ebbf9d14859037b3", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700466532, "uuid": "9d9900f7-5dc2-4bce-b5f2-c15d71436a02", "comment": "Malware payload", "value": "ec94ca5a86ddd70a5c00f860146b4f09672c1180", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700466532, "uuid": "ed89bfd9-2050-42b2-aa07-0a4a94f82e67", "comment": "Malware payload", "value": "75528c508b22da4de70d5d54e88a263ff3d0d8236e7820c94c37dcc318836766db34c2cb4cf63d0a74b3c92dd100cd43", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700466532, "uuid": "59a00224-f740-4204-b3a0-1a9a85fe0104", "value": "T108443860CAD2163D4E4707EEBF018451C4FD892D832680ADE99D177E62239ACCB7FB59", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700466532, "uuid": "03ca955b-2719-4616-98c9-bf9c4615c2bc", "value": "6144:jbhIJnEswvnp5EiPPG0m0cC+BBumgOiwgHUUmQ8:fh3njrPG50P3wgWQ8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700466532, "uuid": "d61a95d9-02de-407c-9432-3b989b859704", "value": 261539, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700466532, "uuid": "64f4c0ae-f16b-44dd-9a9b-725869e09cb7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700466532, "uuid": "ca4fd602-c3fc-45a3-af90-2da19e6a1d5d", "value": "solicitud de cotizaci\u00f3n (Aviones Iberia Express) EU1123ES\u00b7pdf.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41f2cdb5-87ac-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700488440, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700488440, "uuid": "ba3f575b-b3d7-4820-8a2d-a8c232a10be9", "comment": "Malware payload", "value": "85985237380073e38b9572bc47f34392", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700488440, "uuid": "15f5c15f-6a5f-4afa-8ac6-2b42b6c1786f", "comment": "Malware payload", "value": "6c92d4783045aee396d42a4d9c93d61689d61021d3988b5f12c8ad9f2b0ab233", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700488440, "uuid": "91d567ff-70d4-4a57-a76e-0829f77bbcb6", "comment": "Malware payload", "value": "c36ee16ea338b9b1244ce2d39e0e97d714963417", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700488440, "uuid": "2879da46-2670-4119-910d-2363442250fd", "comment": "Malware payload", "value": "ba3a0575d14068047989667e90dcfca1b63b5c76bc30e3cbd3614042a740ed4e56cb174ba67f4490dc3da9f39c4073ee", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700488440, "uuid": "a68ee224-7b61-4129-8f41-29e9b370f6e6", "value": "T11F14BF2277E1C073F16709314A7182625A3BBCA2AB61DECF2B841A7E4E355D1CB79317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700488440, "uuid": "ea9d0337-59ae-4106-83d8-73c2c58c6b36", "value": "b759efdfaa2b106a9868739336fc4103", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700488440, "uuid": "54e7f988-0f76-4400-9ebd-9d46c2c59a95", "value": "3072:VadoYsjQwSmwOkuC/pnVuj8R9T5Ce/N9fcISZyoX6bv:VKIQrm/kuChnVAc9TU6zET6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700488440, "uuid": "7cabda35-17fa-4786-97ed-558a8f78d944", "value": 206336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700488440, "uuid": "572fcfc7-13a2-4c78-923c-016ae84b82fc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700488440, "uuid": "5957996e-8e7f-4a45-849e-06186fac626b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70c9dcf8-8773-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1700464037, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700464037, "uuid": "d1993e25-89aa-4fb8-a2f5-2e36cb7108fa", "comment": "Malware payload (Formbook)", "value": "7b6d0f4b9896f5e24aeefe13757efbe0", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700464037, "uuid": "90ae22cd-fce4-4581-828a-559849586a23", "comment": "Malware payload (Formbook)", "value": "6d8288a0edeabb4ce9889e7effa3983f1b300d49082e5eed5e8d9d256b4e2367", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700464037, "uuid": "8cf72524-fa55-4b83-982b-9cb9ec34379f", "comment": "Malware payload (Formbook)", "value": "91a7f770da2632542ea3f8ea4914a7c664c3c854", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700464037, "uuid": "351ad180-caac-4393-9dfd-12977a6919a9", "comment": "Malware payload (Formbook)", "value": "ef559d2febbb54e840db5f3849f4d3bb33dce714899ef95bd7f258a22c9edc276e1c0f8063b67644d23b652a650c67c8", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700464037, "uuid": "add3fb58-0fc3-4f6a-92c6-5940257f8a26", "value": "T189D4223A3664877BEBE9D9F72050388803B5F6969862D19C0C8630FE46E6FD3650167F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700464037, "uuid": "e0ae1a0c-a9ce-4ca9-88b1-0fc0bb5bce7a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700464037, "uuid": "a6aea798-ab32-4d75-b82f-3c7c251cb9da", "value": "12288:/I361h61EWGiSOEMDy83Q2G2h0AQY06NuROqnEcptjOOhnLMIjq0wrVA61:/tY7GiSOEMDy8g2k+06BqVpJfPwrz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700464037, "uuid": "4ff5983e-6d96-4d9d-97db-521dacd47872", "value": 605696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700464037, "uuid": "cbc839c9-8a0d-4cfa-bce7-fd2cef806d29", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700464037, "uuid": "8272c808-f833-4d87-aa45-83c7f1f98199", "value": "#PO-NX - LI-13-11-20.exe.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac290c73-8771-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1700463278, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700463278, "uuid": "e99fb8bc-28b9-4b4f-9f6e-40a54ec862ca", "comment": "Malware payload (Formbook)", "value": "91a4cedb81deca74ba25b059dcee573c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700463278, "uuid": "18257dde-3a94-4768-a599-9fab3c9e7d89", "comment": "Malware payload (Formbook)", "value": "6e4d266f71044f856641b5162450e86e1e309a946e33fd39450eb99fba10d78d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700463278, "uuid": "3a6b12ec-fe12-44cd-9d8d-42d5b4e78101", "comment": "Malware payload (Formbook)", "value": "0cc226944296723ea893ad07e2767504adae1a6a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700463278, "uuid": "e038708a-f2dd-4a94-8ede-12d570f8fedc", "comment": "Malware payload (Formbook)", "value": "4a02f86393ec7f93f12fb2bcfcdb46d4af0469c517968e85a51c860d8d279efed33695f8ee62900f3ddb969cc506f129", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700463278, "uuid": "832831a5-f522-468b-930a-c62731cb75b6", "value": "T14974022D76D689A2CEC24BB15572BD11D2BD0C340031E56713D09EEFE936E8AAF43268", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700463278, "uuid": "5a6bce9a-ac35-495b-88be-ec800e0d52e4", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700463278, "uuid": "db2e5094-5a0b-47a1-b09a-7ab6fe9ab72d", "value": "6144:3BlL/j1xn1LMxNCJt7J0dk9vPuIEgEYKqsZYXol93zRj10PS5ZGSST:xhL1mNGnvWItEYKqsyXolJzxpzm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700463278, "uuid": "ef2a1ce5-04fd-4c66-91ef-6bc3ef327c6b", "value": 367103, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700463278, "uuid": "a1c6e17a-5e3c-4f63-882f-4fb4b793adfe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700463278, "uuid": "7d268d34-e871-45c5-bd32-dcaf849d897c", "value": "DET INV #2349.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e46961f-8782-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1700470368, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700470368, "uuid": "0c98f735-4b8b-4d4d-84a4-6ab30600c908", "comment": "Malware payload (AgentTesla)", "value": "f14c69b6d3cb08606cf10ba38cc49671", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700470368, "uuid": "37c2f3ea-f106-4466-b63b-f12c7589c6cc", "comment": "Malware payload (AgentTesla)", "value": "6e5f23fa286b84dea09fa536504487be574327f88b5c3f8aac7a652e15367fae", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700470368, "uuid": "beaed963-004c-4979-9085-ace92b0d6088", "comment": "Malware payload (AgentTesla)", "value": "1d5af111e8b145e6cf85785cf87e0ad4271c20b9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700470368, "uuid": "1881374f-7752-4588-b93e-ae200c39a3e7", "comment": "Malware payload (AgentTesla)", "value": "86854ece15716f2dfd09727ac6da44e4671092331a81e8b160bd6f421170d3178c52b36627f88dc0a9fb28f48b1836e9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700470368, "uuid": "6b8d5d8c-ae80-4d30-8955-1fb29d66dffb", "value": "T17F05CDB420A5C7D6D77897FF24AB91305B677C166975C2883EBE30C90EA5B834A40E73", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700470368, "uuid": "2ca02fcd-c9b7-43aa-83b7-f0d769eb12a4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700470368, "uuid": "173f1006-536c-440d-9974-5b642ccb75c0", "value": "24576:Zp1l5bRi40+1KNhQRd7rHcScFcXphDiY:fo+gGDcS5phWY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700470368, "uuid": "c0cf0320-9ecf-4ab0-89cf-db231b07e542", "value": 827392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700470368, "uuid": "f026cda6-8a63-4f07-b0a6-f8e0881bec15", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700470368, "uuid": "db783487-bc17-4abd-afed-6e7b459d0130", "value": "PO-230270.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8009e57-8782-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700470599, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700470599, "uuid": "52b90955-3350-4fbe-9153-6f8ce17570ca", "comment": "Malware payload", "value": "186b6cb6bab8da67643739fab0c25555", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700470599, "uuid": "f7563da2-5e9d-47a0-8739-a74496da46fe", "comment": "Malware payload", "value": "6edb85b89f3753178c0e3617704b7a653b277ee4ba8db6c3c83a0bc0e9ad461a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700470599, "uuid": "6afc19f0-a946-43a9-a977-122e7c3112fc", "comment": "Malware payload", "value": "a370fd8f7aca2b579c63e4f332ae902d1890a853", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700470599, "uuid": "e1eacf5b-0d71-47f3-a21d-f7531476f24f", "comment": "Malware payload", "value": "0ca6191f32f155544b172b73d78abc538a21bde7fff78418dd9d1aa21f249c547f6fef1d760eb7438af51150487fa2d5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700470599, "uuid": "3aa2220c-b10d-4cc2-85e8-f791132a4363", "value": "T15375CE82E4E422D7CCC98B702577CD3286627CE82574685E25F83D237BFA19648D3D9B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700470599, "uuid": "c508d2e9-d2ba-4cbc-9f7b-45dbcdaee89a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700470599, "uuid": "a1d754fa-905d-45f0-bc4e-b04ec7543ac5", "value": "49152:cxy9bhA4VF3FpDkrdviNYpjLLH4dh85IUpq:cxwhA49pObs85Rq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700470599, "uuid": "bff919c3-585b-487d-8839-098e0da72297", "value": 1643408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700470599, "uuid": "e0395c19-ea9a-4764-9e49-ebcb86bf0398", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700470599, "uuid": "ce6504c1-32bb-49d9-919a-526e3a569a67", "value": "PO 1112904 - SONICARE SOLUTIONS INC..exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80312fc0-873a-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700439582, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700439582, "uuid": "d9226dd9-b827-4c0f-ad04-b2ee21663497", "comment": "Malware payload", "value": "48068746deef9292b4c6f1ee5a395c43", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700439582, "uuid": "0574ca3b-7e38-4d7f-92ad-4cec7dd2591f", "comment": "Malware payload", "value": "6ede876c1f12bd1b64cb5d8103d49764d442a0b9615e1ed95c643466eb0a7174", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700439582, "uuid": "f26ab143-b627-4a8d-a57e-94fb4fadbec5", "comment": "Malware payload", "value": "36ea6bd82139136c63f3d478f9ff8f88ecb984d4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700439582, "uuid": "6a4ba329-5da2-46c6-94b8-260ed5967910", "comment": "Malware payload", "value": "f8d6eb3fdc659e8cca6824743ffc23270927e1ab62ce159f5c65f5c8354df0fe6b2e9bde558d48f547cea0079e214713", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700439582, "uuid": "d021542f-30c6-4e6e-8934-2242ea48fa50", "value": "T14AD56B9879419C6ACF4E01F297224608DF91C6875B40E4993AC767CFE72D2E3E5CE18E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700439582, "uuid": "bf46f966-4629-45d2-9d6b-ce16c6827dad", "value": "49152:CN7jcjSIprYpTjYgwLJLvDRc3+Z6JZ5dEzY:48NprYivDS3kMKY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700439582, "uuid": "b9cc3b6c-3a6c-4742-9696-94d2ef27e6eb", "value": 2907136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700439582, "uuid": "8bcfbeff-f2b5-4677-b7e1-75f487e2bf83", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700439582, "uuid": "a599e305-6cbf-4a65-820b-f03f2a940e95", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5ee1aa7-87d4-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700505815, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700505815, "uuid": "f71f4d86-894d-427b-b91a-5ade32c627f4", "comment": "Malware payload", "value": "f98c08f8d2a54814a868a532f7a5039f", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700505815, "uuid": "7aadd4f3-2ac5-4131-95ba-37c82f6bf183", "comment": "Malware payload", "value": "6ee3a0aad24a1be827f07484c6fae41e902e9b2af3942349fd36baa56ccde388", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700505815, "uuid": "fdcab2a0-9799-4d5d-8b89-7e303f50de83", "comment": "Malware payload", "value": "b9d86a8a55c6e29bc1975fb8388d6afec624429a", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700505815, "uuid": "ecebd08e-86e1-4dbb-a6d4-80a40d5267a4", "comment": "Malware payload", "value": "3dbcf83d9546a7cc06416ff05c268432f1b09a36ea7790504a79587b886002f98997f9dc11cb7dbedcb96b6520d4624d", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700505815, "uuid": "f6420c5d-d6ac-4fb5-9ca1-ec997bb7a7f4", "value": "T1D456C021BAE1C037D97306718EBEA22A667DBE710B3551CB63D40F1D1EB05D2AA34763", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700505815, "uuid": "597318cb-9b94-4e0f-a3b4-52fde4377216", "value": "49152:LbWzk8JYy3JDtzkvlpYbBTKPiD+MmR8JYy3ixKMYPgWsnAEppMQn:LbAJY2DtzrbtKPiD+MmmJYrJAEpxn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700505815, "uuid": "481503b5-0282-4a64-a2de-5f0eb44125ce", "value": 6291968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700505815, "uuid": "30eb8d00-16fa-42a5-a674-c52a3591c8bc", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700505815, "uuid": "4d35cfce-c709-4670-8a03-df090fe0dfdb", "value": "rete.vhd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1bffe952-8775-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700464754, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700464754, "uuid": "39cdb19d-12d5-4b26-93bb-fd99a90db79b", "comment": "Malware payload", "value": "d42873987b6763e9290ad1a4f219db45", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700464754, "uuid": "5f02672f-a4db-4fb1-bd3a-d51cbf29bba2", "comment": "Malware payload", "value": "6ff7911f326040812c14050a065e77845c98ac2116dd053be23c0cf085f551d7", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700464754, "uuid": "3b7eb17e-2763-47fa-9024-5478bc3a73ac", "comment": "Malware payload", "value": "5fcef9f2f642280977679832120ff63a8d254fc9", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700464754, "uuid": "64d936e3-44ba-48a5-8c01-a287914cfdb3", "comment": "Malware payload", "value": "eb09d935d27c6335593dc94cd39110b2cf7fa8d47a3d445f7e53d204ca9cd5657074d1b57a5528946cee95e13ee823b1", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700464754, "uuid": "b31a20b5-609f-40ac-b61b-a6d75634ce21", "value": "T1675533FFC8351897766589148358FBC1F5B518DFE8A92640E36431BFA4BA4C392EDE20", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700464754, "uuid": "27d71ae0-b9ba-41d4-b050-f096d5f1046e", "value": "24576:RHWVAu7FJJw2xlCtsddqFmvsE1e7ic+j4eerKFgQzJ:RHMhJJw2UsvTX02c12gcJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700464754, "uuid": "d71f1638-eacf-42c4-bdfe-0ef79ff95cbc", "value": 1401354, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700464754, "uuid": "72e0ade9-ef41-4428-9e46-0c8470ef675e", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700464754, "uuid": "17833510-babf-474c-b9e9-bc14e3d4344f", "value": "FedEx AWB# 985451609094.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0b97bde-8780-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1700469755, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700469755, "uuid": "a7db78ef-b4c0-4c7a-890c-262b2a3e558f", "comment": "Malware payload (AgentTesla)", "value": "85671e750f861f6d50b7ccf4d25f025b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700469755, "uuid": "a06251ce-cb3c-4a24-8a9e-45da9e1a1ad7", "comment": "Malware payload (AgentTesla)", "value": "700a634e601fb89cef7ccc91b4f368b1ec0b9da12a01ce66e35f9dff696fb8f0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700469755, "uuid": "79393a79-faea-43e9-a93d-4e8a24b90416", "comment": "Malware payload (AgentTesla)", "value": "d0fcfa8a82892ca2de5af1fef092a460d165a086", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700469755, "uuid": "a91b2e44-41a0-447d-8cf9-d0dc14c96f50", "comment": "Malware payload (AgentTesla)", "value": "f3a86a4aa45ebd6e152243c9257da32a8b1f94f651e62ca4f8c69fb95d500d069ad6a57ea710c822a4c0af53502186e4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700469755, "uuid": "a49ffb94-7629-4a54-a9bc-57267a67e8a3", "value": "T123159D08BB74913BE949C734A0E24A2092F7EE4962F6D34A5D847DAD1E3237D4B036D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700469755, "uuid": "277b9265-b491-4be9-b2d4-7259e3e371fc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700469755, "uuid": "fb15a650-174f-4b7e-8a66-b65945bd31be", "value": "12288:j6elPWUpGzZycp/tHC2MBS7F6z56RQFPIgMIC7weO5xNiI:ueRbgVp/8i6d5FP7FC7we8xY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700469755, "uuid": "a9e1d575-73d8-46b0-bafd-c4a15afd4a2f", "value": 956928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700469755, "uuid": "7f19f7a7-e913-4b5b-a966-dd3416434e25", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700469755, "uuid": "d69f5aa8-af51-4a47-be99-c0df5bd5b8a9", "value": "QUOTATION_NOVQTRFA00541\u00b7PDF.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "097ff249-87a5-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700485339, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700485339, "uuid": "effcf1b9-aa87-402a-90d4-f3ebeef09513", "comment": "Malware payload", "value": "4b66d223b0f4280ad86b1461bf043241", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700485339, "uuid": "f758ee4b-27ef-4e92-9c51-38e00a3a6481", "comment": "Malware payload", "value": "7107780930bf2cf64102e18ed81d74e244eaff05ae14341ac8b7818b9190be4c", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700485339, "uuid": "189e6d11-b435-4693-ab58-36e0e1ce2ff4", "comment": "Malware payload", "value": "71d79203a79d1dc27dd9febf7fabc7679d340613", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700485339, "uuid": "f0eb570c-1c93-4eb2-94ef-60352b815b06", "comment": "Malware payload", "value": "1e1d8dc36da909f5aa375a78a087a041b65e7a36ebd5e5f2e290357b670412ae2c6d715a9b24e22f9f6e2522e42e6f98", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700485339, "uuid": "10011c2e-a3e0-4689-89fe-e3bf5314cdb6", "value": "T12C6533BD5A2790EC698486064F4022375ADB5B74432BB36FA8A9BCF064D015DFE7E334", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700485339, "uuid": "82721782-4788-4672-9f22-0072256a16aa", "value": "24576:i2bgT85/gGZdJeHV1H0pr/NPoCpVLPIvG1uSRYK2OMuOBexqb3N14XoSg9jTD9VJ:lcT86+eH7UzPoCpVDIvyBVzMgkTPf9nR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700485339, "uuid": "47b0d7bf-c0d8-471d-90f0-ba79c532d319", "value": 1468104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700485339, "uuid": "83019721-b498-4cb8-8f9a-d89202943769", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700485339, "uuid": "f60d5487-f272-417c-aa02-71d271b4575e", "value": "config.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b146f390-8774-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700464575, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700464575, "uuid": "a026e9ed-8017-4612-bdc0-b2abfd0930b0", "comment": "Malware payload", "value": "a45cb2b613de5e64e0f9fef266846d0c", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700464575, "uuid": "078a4278-1803-4355-8db7-911cc00b3c04", "comment": "Malware payload", "value": "71724246be0954a5fdb76b28e0279887b8d9278aa09db2c5863460a390da0664", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700464575, "uuid": "a2469eee-33c2-44d0-9848-1b41b5236886", "comment": "Malware payload", "value": "5ef4ea5cb86178e9959820f9b7e4874a75cf8576", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700464575, "uuid": "71798d52-d4a2-40d4-8d9b-a4b5718a6ec4", "comment": "Malware payload", "value": "eebfb62556bd14d34758f40500a29bf6e67e29225ac5500dec9c05679b4a6aca16487d9bc24a2ce6aa95d65db07b687b", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700464575, "uuid": "3b4d4f2b-5269-4391-bead-2062801262b9", "value": "T117729F6D849880BDCB0644B850132193F7E8FAA7B26BA91AB314EF18C57B59ECF40758", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700464575, "uuid": "092a7a8d-112b-430e-951c-ebe3d9d0f9b5", "value": "384:qyXMSd8WKs8PL8wi4OEwH8TIbE91r2fRiJYhviJ2UF10e:qcM5h5P3DOqnYJc4vE2UF1l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700464575, "uuid": "b7096d69-a49b-49db-b3d4-92855d874bc9", "value": 16436, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700464575, "uuid": "b5c33ab3-faeb-4afc-bbff-014684d2cab7", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700464575, "uuid": "fb1959f7-f1a4-4724-ac24-5c06bfc862af", "value": "Image 001 (Receipt).docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9062a3b1-8787-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700472680, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700472680, "uuid": "5d80d151-47c9-43b2-b284-d82e935eab4b", "comment": "Malware payload", "value": "5f3934abddce53a64ada5ef46b4a1d97", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700472680, "uuid": "8dc2f884-64f2-4ebb-92c4-a1dac3f13e9b", "comment": "Malware payload", "value": "725bbf0e335362a78d5c9787914a8ec591858186b6c368216bf758436e8e4d04", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700472680, "uuid": "8790811d-209d-4f62-a96a-0216a981a2ef", "comment": "Malware payload", "value": "898f1cf7536af84dff36290850aa0039f86822d1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700472680, "uuid": "ee05c2bc-9e22-4512-a058-6ecc1e936c08", "comment": "Malware payload", "value": "1ebcf1939a882a0e126b105e8f1526da946fa4fcf647aedd7beeada2ee2698eb88a89038de699d037447b068325d1dab", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700472680, "uuid": "4a0a2e50-7ebd-422f-ab0a-bf55943fbfdc", "value": "T1DCC42396B5850273C9AC0BB71A6A72001BE8C90B855BC95D9EC453F66BB27031FD2F73", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700472680, "uuid": "b473d6a2-c8a8-42af-860d-9f3502b3cb51", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700472680, "uuid": "08a9f49d-9ba6-4d1a-899f-13f7112142ec", "value": "12288:avCeEBP7WozzCQDli1nMAtv1tMczJU+NGbOecO4U+:aqeEpWoS2i5MytuKKjOtC+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700472680, "uuid": "1e8936cd-a586-4ba4-bb4b-5bb711491049", "value": 587264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700472680, "uuid": "c1913afe-62d8-4518-a234-9d38d0735fe7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700472680, "uuid": "83abfce0-b916-4991-b55f-56b25b666857", "value": "SecuriteInfo.com.Win32.PWSX-gen.12645.19493", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e67c6ac4-8751-11ee-8907-42010a9c0042", "comment": "Malware payload (IRATA)", "timestamp": 1700449632, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700449632, "uuid": "4d28aee6-5ba2-4efe-8398-f4c2994b2a60", "comment": "Malware payload (IRATA)", "value": "9764064fe0987903056d5aae34dbd162", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700449632, "uuid": "1f74ff18-be1e-4353-bed3-cbd637ba73cd", "comment": "Malware payload (IRATA)", "value": "730862de1bb846e0effbe03dfe0e52ec2dc72f61c384fcf760c5a4e519999118", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700449632, "uuid": "35402e25-16e8-4226-90bd-9fe14983aa32", "comment": "Malware payload (IRATA)", "value": "3dfec37fc431f90852cf0409d6c0314e50a54bb0", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700449632, "uuid": "5e905923-2f93-4a1c-8a7d-5d03a44a8456", "comment": "Malware payload (IRATA)", "value": "03b34418449a09f05612bb1659f35e254a247dfbd5ce035c57442a491c3971180286cfdaeb170a09e74a30e79696f0f6", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700449632, "uuid": "9b759182-fac6-478e-b1d6-b7cc851fc01d", "value": "T16B851252F36AB967CC31C03224912B3955175E64CA07FB4A385833BE69BBDE80FC16D9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700449632, "uuid": "745819b2-b0be-4cbe-959e-c941e6d66ad8", "value": "49152:WsFkkzEXp4NgmG0kIzHfXkDyH3eofU8UDMFu:FkkoXUZG0vHfXkie8U8UDp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700449632, "uuid": "ff997d55-017b-4575-8b6f-f7ad78ed7bdb", "value": 1777141, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700449632, "uuid": "72d78580-1e1e-4f35-837d-c47f47cfb245", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700449632, "uuid": "bd15e60d-cebd-4187-9c68-8ad5666c74c8", "value": "app.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f42da9fc-875b-11ee-8907-42010a9c0042", "comment": "Malware payload (RemcosRAT)", "timestamp": 1700453950, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700453950, "uuid": "15d00f88-315d-4ca6-a3fd-bda1a1dfc9f6", "comment": "Malware payload (RemcosRAT)", "value": "6e0cec33dbf93f5671f120f2401134ef", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700453950, "uuid": "61ab9868-d5b2-4f39-ba87-47d2c733799b", "comment": "Malware payload (RemcosRAT)", "value": "741b7b64f2a1eb8aca439c9a4c304a90fba48c41c787114b8aced6c3102a5568", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700453950, "uuid": "fcb454e4-1a4d-457b-9077-021b2c291c0d", "comment": "Malware payload (RemcosRAT)", "value": "a13160a24bc26426f6d9a36d1742eadcde13735a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700453950, "uuid": "6eec70a8-c1a9-49bf-883d-e181cf51cb3b", "comment": "Malware payload (RemcosRAT)", "value": "b0ee64234cad7681ac6e2eb0d49c3c274a8fa57b75ef0ca442d972f4a99feceafd84dcc3f06bcb53cd1a3a5f38a3c2bc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700453950, "uuid": "9a02a374-c36b-475d-8c0d-8f646a0aef6b", "value": "T1FD1523A0B95C8BABCA8E25F131B2640303F6B39DBC13DA8D9DC655E4CDF6F451542A23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700453950, "uuid": "c1dd7204-64e2-40b4-bfdf-fbc16cdb3bb8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700453950, "uuid": "d759c6e0-6e2e-4135-b5b9-30dbe7de6ac9", "value": "24576:EOY7GicD/ZiGALsAwAPSjznUBEqzQ9lUyG9WbU4oZ+8e:EBGJLZxALAAUUHioWhoZ+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700453950, "uuid": "703f4f43-3667-4d62-9132-80e34b000f09", "value": 922624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700453950, "uuid": "c67433af-7021-445c-b4ae-383d17d51ae2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700453950, "uuid": "e88640bf-df49-462a-9c79-118498102704", "value": "SecuriteInfo.com.Win32.PWSX-gen.20143.25935", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3e51958-8776-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700465519, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700465519, "uuid": "a77054d0-4a40-4fbf-a2d5-bec7110b89a2", "comment": "Malware payload", "value": "4846c5a338df42f18f00c1dff599ea43", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700465519, "uuid": "ee15e49d-35cd-4b9e-a553-a564849f871f", "comment": "Malware payload", "value": "742993e653953f9d040439ba720e56b5757420927bfe385648f15dc98dd8c25f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700465519, "uuid": "35e96ef0-30a9-4cd5-b2e2-b675d28595c1", "comment": "Malware payload", "value": "5e5f417ff07d2cf455cabc2ace23a3ddb556ff16", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700465519, "uuid": "be388bbe-44f5-484d-a5d2-742bc9ca0436", "comment": "Malware payload", "value": "ba62b4fe5d327c0fd5685c109151cdc1c44df365936cdb79bed9e0ebdaa429537604620dad4a152048b33896c3a006f5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700465519, "uuid": "2f6ee96d-5b81-4f0d-8212-426ad420bd79", "value": "T105D4120833EAC739D96EB77A90B143551B71A9516837E34E1FA592B93E26FC0CA81F10", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700465519, "uuid": "432e46c9-0789-477d-8446-c12e6b8d7c20", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700465519, "uuid": "a11493ff-0c98-42f5-83d8-11e133897109", "value": "12288:q0V7g6jJRjqgbNkvDmr/xBEdXSLNe+78AqE6oO5Kf21F8/nMx07:qYXryvDy5QCLNe+78g6o1fZye", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700465519, "uuid": "4fc737c1-3410-4d7f-9096-f934160b76ed", "value": 624640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700465519, "uuid": "70791524-fe0e-48e5-b2d9-222c5b873b18", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700465519, "uuid": "7f5c8e22-3460-41d8-84b9-690717b7d8e5", "value": "factura.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1f4a762-8770-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1700462939, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700462939, "uuid": "d1d85bff-ac62-4556-b1da-28f1d839bb11", "comment": "Malware payload (Formbook)", "value": "82ddedc13989499dfd47a7f7d711150b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700462939, "uuid": "966fc387-a46d-433e-9c5b-9867d8755c94", "comment": "Malware payload (Formbook)", "value": "74db13b26d2854e3e6005bb2cd3d304df34c25149c717811008a41bbd4e6da3f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700462939, "uuid": "7a732896-10ed-4622-8ddf-3a237983524a", "comment": "Malware payload (Formbook)", "value": "364a1fe147482160e3dde718123c6b051affd377", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700462939, "uuid": "9128523e-eac6-42b0-9cdb-3fa8e02dcc0d", "comment": "Malware payload (Formbook)", "value": "bb630d51f41c8d700176d403ec9e2d7a6ffa38b750e9f371020c012666bdbd50d658434019f38ee1396f43ca088bd941", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700462939, "uuid": "2e15b423-47b2-4504-ac83-500c745bb079", "value": "T11F7412927BF41AB7E54205B1893BC994D9785D349421A6832BA0FE3F5EF02C64D8339B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700462939, "uuid": "263823ab-4646-4be8-a057-9019b4a886d1", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700462939, "uuid": "3ae1957d-3cc7-4a21-b510-cf16c02483af", "value": "6144:3BlL/SbHNz3Un31C5LbcPDz+d2EeDB8VMb9qk6WwHy95E40jb:x8bHJ3ulC50PeNet+MEk/Ri40", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700462939, "uuid": "7aa97313-a291-458d-909e-fad63b4c46c5", "value": 365315, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700462939, "uuid": "33352e32-ccb2-4a53-b1a7-7d0037f464c7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700462939, "uuid": "da5e7184-e29f-49fa-97c0-ba12efbeb1f6", "value": "inquiry ESP1285.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "485201ba-87c5-11ee-8907-42010a9c0042", "comment": "Malware payload (RemcosRAT)", "timestamp": 1700499188, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700499188, "uuid": "e96f9bd8-0d15-4c0b-a468-fdfa580e7af1", "comment": "Malware payload (RemcosRAT)", "value": "6c37b81f882ba21df3b985ba287b3ab2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700499188, "uuid": "a5352271-6dd0-43df-92c8-476eb59ef042", "comment": "Malware payload (RemcosRAT)", "value": "7577b9bf9939eb0865359788ce1f0d96eee3f79d401e5fa8ebb3e05d507f46d1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700499188, "uuid": "a363826c-a0b7-4750-a9ce-27b69eb52a63", "comment": "Malware payload (RemcosRAT)", "value": "480125d7654b843fa89df16be5ba973f6d206c5f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700499188, "uuid": "758ff3b0-2178-4a32-9e36-b8f9263b22b8", "comment": "Malware payload (RemcosRAT)", "value": "9f23ddce096e5edc97d6383405a63ef95f2df6a6ee0f1df27a2b23f8361b789cb1dff6aa3ba4f7e76bfe70d154e2b2a6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700499188, "uuid": "a9e5bb3e-a413-491e-b90d-8061afd3bb5d", "value": "T12315235574B4835BC7DA3AF6807CB51503FBB0920C07C9E81CC931FA8AD6B4B9A09B5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700499188, "uuid": "ed37f067-cdc0-4aff-b207-07cbe3370502", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700499188, "uuid": "8fe1d130-f667-4a76-941b-e3a97cb95f05", "value": "24576:8CY7Gw7AQsAhsPfJnduGz0s6QYc0iLHWqF:8VGw7p3hefJdrz0s6QLLH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700499188, "uuid": "df123dce-75c1-4962-bb3e-0df596100de8", "value": 922624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700499188, "uuid": "fa81c754-2a4f-4d33-95bc-c6d41ff45f36", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700499188, "uuid": "fbd517c8-e194-4fc4-a59f-daeef2cab298", "value": "RXtmwI.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19e8f3c2-8783-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700470764, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700470764, "uuid": "87fcf215-83ff-4bca-83f5-1edabefdb46f", "comment": "Malware payload", "value": "dfb73550b16f3035977b82a6ab3a5bd3", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700470764, "uuid": "ea3a2177-66d3-40b5-9b00-8ae642781939", "comment": "Malware payload", "value": "76f948c084b30647cc6fe5aa31ad9a8af237f8b3d3d48d7811fbe56c01a82057", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700470764, "uuid": "919d7474-6168-49b6-863a-cdc1f08c3c4e", "comment": "Malware payload", "value": "16a036f7b082c3343d6277ac54efd775404b4402", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700470764, "uuid": "83ac66ec-7f79-4695-80bd-dbca0c368b43", "comment": "Malware payload", "value": "d2a8c3ca798f5c70c0088ce3a627a1c086459a19aae1add6d7e8012acd69b376ec8d8882922e722041358c99459958f0", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700470764, "uuid": "02bd6fcf-1214-4f19-8d56-e094246e029b", "value": "T170E4233155A6CC5463FFF61E60BF0956E3D73EE7851B09280135709AB5FA2322AB8137", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700470764, "uuid": "2670a2d3-029d-4653-9e2a-1ab5ebcfcbe5", "value": "12288:XD5jKnoYMXeov9VKvZzHhLKJ2dzR0cYPXdFse+pnK/H+U4:1Dv9kjKJ2rtRppKeT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700470764, "uuid": "79e352a2-b170-41ce-b010-d25b66bb57a6", "value": 657962, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700470764, "uuid": "0fc52669-c928-4d85-aa2a-714f60ba0f85", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700470764, "uuid": "116de9b4-38bb-4587-9c35-3f4a9de2b81e", "value": "kVDT.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87df4b53-8781-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1700470089, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700470089, "uuid": "8c46be0c-a212-451c-85e0-37e7617f5492", "comment": "Malware payload (Formbook)", "value": "d15f94bd8f51b08fc32f062428527929", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700470089, "uuid": "061f113f-ba0e-443b-8d88-8d22229b80bc", "comment": "Malware payload (Formbook)", "value": "779e93f492a484c35faed67a96c0a64d843f66ed242a979de370ddb29c094877", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700470089, "uuid": "d94633eb-4751-4525-8860-59e24e8196e3", "comment": "Malware payload (Formbook)", "value": "3397bf8819aca625619d90b120bb2a232c4fa4bf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700470089, "uuid": "b0e8b0bc-f44d-4d87-8cca-0a24da06bfe6", "comment": "Malware payload (Formbook)", "value": "bc68f4c864fe519dafae69a22782ba9629d5bf3a945643fbec029ea9e65f59f817927e5627c80c2251941d8cd32d46e5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700470089, "uuid": "6a09fcae-569b-49e1-83a8-cafb1d3fa2e4", "value": "T19974126366EA4A67E43342FBCD6B47FAD273D1005C24A35B0F606F5AED115C20D8E6CA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700470089, "uuid": "19d3dd6c-3985-4141-b835-ff1600acac2b", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700470089, "uuid": "06153f78-686c-4fc4-aa1b-17f7ee643a04", "value": "6144:3BlL/dL2eLick4a8+iD4LybEeWF53KCvNBjD3txf21YkG/Z3akzxZN3G87avIDV0:xXqeLiR4ES4L1FfvNBfdxf21YzZ3ak9a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700470089, "uuid": "90ea2559-70d7-41a7-9a2d-dd3224853a88", "value": 367588, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700470089, "uuid": "ba3341c8-c718-4fc9-b449-be88230d29e8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700470089, "uuid": "a5d4f4d3-ecff-465f-8ab4-ec9c15911999", "value": "RFQ02811968.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2842a27-87d4-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700505782, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700505782, "uuid": "85b82740-7ed9-4e4e-9c6e-e477f17b32a5", "comment": "Malware payload", "value": "6282ea5d571c8fc7b8ec3e8052bebea6", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700505782, "uuid": "bfd6cd2d-3442-4009-9650-b5f8ffed7a97", "comment": "Malware payload", "value": "7938b102a35291b030efb252bd1910e3d2f264f0361921a16ce560ac355a2bf2", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700505782, "uuid": "1e88b062-2208-42ce-8c23-406cf475266b", "comment": "Malware payload", "value": "aa2059383c8069e24ffff24030f7f3bf7cd3e6a9", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700505782, "uuid": "2ea58179-478f-4d6c-a92c-7f581190c796", "comment": "Malware payload", "value": "bb2e0c2a5c4e761ceab4b1b90bda153a9719948a0cb3590d37f1b2500589d10e0ae003c0596c9791eaf4ab9719134eb2", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700505782, "uuid": "a7b7eca2-d1b1-43bd-af35-0437e5ae2df3", "value": "T1D4A533DCE4288014F7A503F2892940ADF9D89754EAFF2DDEFF58422011E7912DB16E3A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700505782, "uuid": "98542d44-f5d7-42c6-84be-655162fa353c", "value": "49152:Xs2AQBbHQobeduZ/tq0sn8H1HM0W/uo1S2SUIpmiIItUx1311heg:Xs2hBbwobeUisVs0W/uo1adQiIIgZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700505782, "uuid": "1cec3720-2dcb-474c-b195-086a25267734", "value": 2137596, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700505782, "uuid": "3c9ddf08-e460-469f-92f3-44625615d9c0", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700505782, "uuid": "3cefc4b2-34eb-4710-87eb-512b7e196641", "value": "entrate.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61c359aa-87b3-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700491500, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700491500, "uuid": "aaf8ecd9-6b82-401c-a84d-8b506f8149c3", "comment": "Malware payload", "value": "5b6aa1086f2d978c8288c6c6f30cc03f", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700491500, "uuid": "7256e563-a8ad-485c-a286-3ff45f0fd54b", "comment": "Malware payload", "value": "79914af587e526c48a13510cf04e9e1fcd391313b72b8ab947ffe57278488a1b", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700491500, "uuid": "86ba053b-dd06-4689-aa9b-4fc39452ceef", "comment": "Malware payload", "value": "d8f45817899cb072075b2f26ece374f76ff1c8e0", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700491500, "uuid": "bcf8aeb8-f769-4781-9035-3fd5c73bba7a", "comment": "Malware payload", "value": "35b42ebf2bb9da9815388e2908d7fc23f051c115b6eed0faf259c322b4421236d19d25faa0c992642ac972d8d75df920", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700491500, "uuid": "c349e4a3-df2b-48f4-a748-b768ae63b926", "value": "T18F9533B0A44BDA15D4B7B77DE0CAB6D58B8F1F9D385A0EC0682515736D0A22F0DE813E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700491500, "uuid": "90652909-87cf-42a0-bd81-de16f7c12554", "value": "49152:yWz0ghMTq8FN6TVX1Mew27raiJfgvpZC0uRwg/LlGP:yWgPnETcerraiJfgxZC3lGP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700491500, "uuid": "1f9f0a5c-06f3-42ad-9b45-370b06fa365d", "value": 1900999, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700491500, "uuid": "514bd935-4af5-4fb5-bd21-8aa158de8568", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700491500, "uuid": "a0138bfa-5170-4f9e-b84a-6dd928c464b3", "value": "rete.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3af0964-874d-11ee-8907-42010a9c0042", "comment": "Malware payload (IRATA)", "timestamp": 1700447909, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700447909, "uuid": "787add4f-c575-463a-97d1-e3463fac6c27", "comment": "Malware payload (IRATA)", "value": "c0234b268d9360134d50230bc76f2ed8", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700447909, "uuid": "2499242f-1ef1-4b4b-9112-9d1ead22fdc8", "comment": "Malware payload (IRATA)", "value": "7aba840cab8eb7550f125127b2cd2de247dcdee330588f05dfcf5d54951dbb3a", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700447909, "uuid": "7bda3698-368d-46a9-b059-792052beb228", "comment": "Malware payload (IRATA)", "value": "46fe9939e2574fbf993f0cba37f157049dee3488", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700447909, "uuid": "cc594c08-d52e-4719-a123-ad47d754fe7c", "comment": "Malware payload (IRATA)", "value": "8d3f0c6a33f5b28d8e06b600e63aa815401cbfd8e77972c11ae9ffef907e7e1cabcd2177c0e0e3609d827ec31b5493c8", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700447909, "uuid": "4198cf69-8305-4886-bc28-7081ef7cd79d", "value": "T1DC1626EE9F115D2EC9A40E3540BB01F622090754468EEA3D19B8A1B93C67DF87743FB9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700447909, "uuid": "3a0f05d3-362f-4615-82a5-a2363d4962fa", "value": "98304:MK8ssfZIG8mZl1tsmge5y6S9l7ewXskk+gI6qQ78aQh:MCsfrZljsmzvqNew8qgIDQVQh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700447909, "uuid": "f55aef40-1624-431d-82ef-a217d81759e8", "value": 4245597, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700447909, "uuid": "70409e5c-e782-4a46-9f66-67f9478536ff", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700447909, "uuid": "014e79ff-35ad-4ef9-9c0f-de22eb5529e8", "value": "saham.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d00d4bb0-8779-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1700466774, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700466774, "uuid": "d9064693-f430-4df3-90a1-9ff163f68e75", "comment": "Malware payload (AgentTesla)", "value": "ff1dfcf9c9c16ea3db57b267cae3db5a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700466774, "uuid": "26696c54-8768-407f-be66-ceb99422fff0", "comment": "Malware payload (AgentTesla)", "value": "7c84245b302074df4877eed9eb06aaf99a4a342b2b88d50c4d008581325ce36c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700466774, "uuid": "c668acbf-c6eb-4601-a9b2-bb92d6f36ba7", "comment": "Malware payload (AgentTesla)", "value": "74ac6d42301b8c3d398612761e968c8dc8888f87", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700466774, "uuid": "baa184dc-094a-4267-b5ae-84e3cf85c429", "comment": "Malware payload (AgentTesla)", "value": "78b642d368ee13b81479d337c4217556dc64c1947fff209668cc731bd5c941252f8f52c73706b2f8197e6ab8cdba41eb", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700466774, "uuid": "c96bc3d4-d7d5-485d-a9ad-454c613efb2e", "value": "T1E4157C9D325072EFC86BC872D9A81C64EB607877930BD203A45326EC9A1DA97DF151F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700466774, "uuid": "5c790d51-d5f0-4a71-8000-4e31f013b35d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700466774, "uuid": "7be032b1-43be-41d8-8c34-80fa1ca9661d", "value": "12288:0NK/EvWXGFN/jjjNjm5GD/zHfOsPVeVTu7BrBQoq75wcflnvo1xQT74cS3wUeE78:0K78bjjpRDL//8MkmcdEx60cZovgYqN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700466774, "uuid": "ae0eade7-8576-4cfc-bfe1-4019478e1afe", "value": 934400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700466774, "uuid": "b342f29b-9b39-45fc-8f5b-7698653dddf7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700466774, "uuid": "d993e1f6-66ae-4146-923b-dddcd72007d6", "value": "Purchase Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2320946e-87f9-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700521460, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700521460, "uuid": "9112b3ac-095d-49db-8159-520af215b078", "comment": "Malware payload", "value": "ec8fef72a73ff94440235fc1b3f3f690", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Rapid", "colour": "#5FB088", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700521460, "uuid": "46e09159-d991-4047-a4be-9bb225fc8e8a", "comment": "Malware payload", "value": "7d98972d5c78e1d4969da76856d6818942b606c267efa67fd31d39ae77497e9c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Rapid", "colour": "#5FB088", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700521460, "uuid": "f45e828f-f47c-42a1-9399-477c450459b3", "comment": "Malware payload", "value": "e651cd12a2493b9c2d7ebd8287a2fd29b8f4cd9c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Rapid", "colour": "#5FB088", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700521460, "uuid": "3f0f4433-5a39-4606-82f7-fee2b9d51268", "comment": "Malware payload", "value": "5768612368abcd6fde6b251c9b4d96c0c572fb1f99df8b93746557a18afbc29156901e033a97a70b7acc084b54982d2c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Rapid", "colour": "#5FB088", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700521460, "uuid": "c41f8958-63b7-49e4-8d19-9bf1daf37e43", "value": "T109151801B7A00018FDF316FA4AFE70AC993DB9F2172894C761C46AED9665AF07C31667", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700521460, "uuid": "9cbb24d5-9d61-457d-805a-dd933e444c28", "value": "d999d23008cd11044758e92d9fe0a834", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700521460, "uuid": "03c73ed0-cc0e-40ec-955b-a8badbaf5f8f", "value": "12288:d31hZus7pQqiiyuuFuawu2zhjWBv4+1FMUUfW75CXQKXTZ1VG:1r1S+NjWx4+1SWV6Q4n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700521460, "uuid": "78ff88d6-7769-4072-868f-240619ef8db7", "value": 915968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700521460, "uuid": "fec11893-addf-4c73-877f-6abd34e16fe0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700521460, "uuid": "a1a75c8b-70d8-47c0-8a81-adf2dadd5723", "value": "7d98972d5c78e1d4969da76856d6818942b606c267efa67fd31d39ae77497e9c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "140e1754-8794-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700478055, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700478055, "uuid": "04c8721a-553f-42b9-90cc-4497542757c3", "comment": "Malware payload", "value": "3e797df6c23bae007f16dde16d4374e9", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700478055, "uuid": "986e7b32-6572-4a73-a179-38e8c561b54b", "comment": "Malware payload", "value": "7dfcedc537a858be0d598ef2f327d4fa2aeb3f4191a7f724fcad85a1c894ea53", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700478055, "uuid": "ce33c8c0-003f-49da-b551-1f7b7d39b362", "comment": "Malware payload", "value": "42128dd598f267637be86fdec4dc69480b6ab810", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700478055, "uuid": "046ab122-e012-4eea-9d1f-878100821f45", "comment": "Malware payload", "value": "eebb27715607e2a80c8780dfd8d4a7a9d68c7ae728b854aaecd9bc8cad993445eca690c109cf5545cc18a106e534feb2", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700478055, "uuid": "d7e810dc-d65f-44c1-b6d4-d8233b5fab72", "value": "T145D02358C55CC155C18144168098FD849C0DF44454F5C5CC5280D6965C814D0DC47FBE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700478055, "uuid": "e9695979-b9cf-4fa9-8e2f-1495bb85d029", "value": "6:HRYFJb7z9sZOCmVX/LfwLTmQvyc1yc54vVG/4xHn:HRYFJHzFCSLoL1hy3VW4xH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700478055, "uuid": "5e4eab58-e01e-46a3-b68e-0b0a656d6053", "value": 204, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700478055, "uuid": "72d7b9ce-58e2-4d59-a304-92b36338291a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700478055, "uuid": "5ff14ccc-e886-4e4b-abfa-7b2785f1aa90", "value": "Amministrazione url", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "121d661b-87bc-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700495232, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700495232, "uuid": "6bebadd1-b397-4a39-baca-32eb159f7424", "comment": "Malware payload", "value": "0c906e54f56be90265818b449b42c76c", "object_relation": "md5", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700495232, "uuid": "4d58e038-41a0-4b7c-87a4-9027e4723354", "comment": "Malware payload", "value": "7ffd937a02fb56a1e687c22bf407e88559863bd09d1a8cd18eb63c44545b5d87", "object_relation": "sha256", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700495232, "uuid": "60328ed0-eb1e-432b-b4ea-ee67f4bfed11", "comment": "Malware payload", "value": "5f5e554cac2c63f38fc1c2b8c11f8bd037c4427a", "object_relation": "sha1", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700495232, "uuid": "5bc9cc16-a7f5-458d-87a1-047c3c84501f", "comment": "Malware payload", "value": "423e2088a519ebc33558df426dbccacc7fc6b034868a541525bf7abc6bd4b5fa2519b48ca628b8eb139b8efad152a09c", "object_relation": "sha3-384", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700495232, "uuid": "1f714937-4f1b-4d6b-ab63-c211eee209b0", "value": "T1A0D4234FC8F57142CB51983BE0D27F1529F216B8FA4C14BAB21B5DDB878E8893120ED1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700495232, "uuid": "d959decd-5e11-49f0-a660-508c103a975f", "value": "12288:Q5xFJV5WYDeP+kaLC7DssWGunTFDmDzheFND1Y70ymM19r:SfJV5pDeP+3LC7DpWGCFyD2JgBmMX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700495232, "uuid": "32acf0d5-1d08-43be-a910-1dc325d5e875", "value": 618691, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700495232, "uuid": "c71cb741-debf-457c-8179-5d2787eb236b", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700495232, "uuid": "621c06df-7e36-4fc3-a95a-69c40bf39462", "value": "DHL - Invoices - Past Due.7z.001", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "619114bc-87c8-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700500519, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700500519, "uuid": "394ea4b9-c608-4e8a-83fa-3884ab4d44b8", "comment": "Malware payload", "value": "619601435755a37e712cf52706ad0383", "object_relation": "md5", "Tag": [ { "name": "WikiLoader", "colour": "#264CCC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700500519, "uuid": "6c74b631-04d8-4c89-84b5-b65a307020ad", "comment": "Malware payload", "value": "80b33a175007e37759bc6f1ad34f8c88aafd45dc03fe452168db85ffec490809", "object_relation": "sha256", "Tag": [ { "name": "WikiLoader", "colour": "#264CCC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700500519, "uuid": "9f4d8536-f5b0-4acf-8d58-0b7d21b27cca", "comment": "Malware payload", "value": "6fd9c3c14b7263e85a60a37f5c5a339877053b5a", "object_relation": "sha1", "Tag": [ { "name": "WikiLoader", "colour": "#264CCC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700500519, "uuid": "66f1fddf-042e-46e7-8254-9efe66a57071", "comment": "Malware payload", "value": "068af8915bedc0e1bdb2ed50da4c44cbc2692899b88888889f79964665445e7c18819cc10f32af22b3ca80953a5b91d3", "object_relation": "sha3-384", "Tag": [ { "name": "WikiLoader", "colour": "#264CCC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700500519, "uuid": "11781f9f-398d-40ac-b047-a67cd86c0a04", "value": "T15F663381829B77A5D8BA717455A88543F018124EE54C614A3F280C5F9F8ABFF9B37FE0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700500519, "uuid": "9d958d16-1c1f-4a95-b0ed-a31a977af1c5", "value": "196608:ccgr/8uQh7j1szZ7ljV2oBzAKLyLQIM9OsDOIIymm:lGdQhWN7JVDBzAO7IM9/RIyl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700500519, "uuid": "772cc8b5-34cb-4ad8-b045-8e2dfa926d86", "value": 6533958, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700500519, "uuid": "480c8a1f-8c4c-486e-be00-e9bb68cf80a9", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700500519, "uuid": "9b9b2e8e-63d9-4823-be64-7a47a9ba0462", "value": "CCleaner.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee4b5563-87f8-11ee-8907-42010a9c0042", "comment": "Malware payload (Sodinokibi)", "timestamp": 1700521371, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700521371, "uuid": "c8faa46e-a6ac-4e3c-b7d3-c7be3a565a64", "comment": "Malware payload (Sodinokibi)", "value": "7e18b037a068c56417fb8e56aa7e49e8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Sodinokibi", "colour": "#6E2BED", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700521371, "uuid": "48aeb6bb-b31f-4008-b7d7-4f565619727e", "comment": "Malware payload (Sodinokibi)", "value": "81689f1be92c8fb7e94fe241441c7eb43cfb77c6d23592b0248566bd709ff2ed", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Sodinokibi", "colour": "#6E2BED", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700521371, "uuid": "28c28ca6-ab44-4a7c-a50d-14057d47f972", "comment": "Malware payload (Sodinokibi)", "value": "f6739569a24358c8c060d7131be70712f70f36e0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Sodinokibi", "colour": "#6E2BED", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700521371, "uuid": "11152f2a-19d9-4d0f-861c-16cf851cff59", "comment": "Malware payload (Sodinokibi)", "value": "50ca632abce6851062c79fda79e01c23264684e66be6d7008dfed3bd16ef5524875227289e772394705f91442bcb2160", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Sodinokibi", "colour": "#6E2BED", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700521371, "uuid": "a778fbb6-57b2-4ef8-906c-805ba70bbb59", "value": "T12FC3CF63FD9146F2D89341F2532F3F1F99BEBD34A00114F6E32149885E2A493EA17A63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700521371, "uuid": "c313fd21-00b2-4f20-b889-4eeb8dae0a9e", "value": "be7a6c7245cc62652777c427fdb24506", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700521371, "uuid": "58934f3a-44da-44d6-92a9-1511302561ed", "value": "1536:AkdeUcaK8Qz4PQIUnq5WMrAmyopACC9ICS4A0vh4NKwTNA28V5/Ogsck:mlnXEXyk7yvh4NKwTNF8V8v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700521371, "uuid": "6533c5d3-7409-4784-97bb-fa2f4ae07d71", "value": 118272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700521371, "uuid": "3332eaea-0319-43dc-b7c1-ae80b3166352", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700521371, "uuid": "f2fb5089-f63c-4af8-9844-49c1958e8281", "value": "81689f1be92c8fb7e94fe241441c7eb43cfb77c6d23592b0248566bd709ff2ed.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4487cc8-87ae-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700489491, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700489491, "uuid": "895ade11-0a07-47c1-a469-76f468132aae", "comment": "Malware payload", "value": "d7f4238ff5acac175beb585a26c9cef2", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700489491, "uuid": "ce4fad3d-6f60-4a8b-8b00-7646e0c090b7", "comment": "Malware payload", "value": "816a6f59d836acb9545db79aa246be0be62f43e330c5c93796b1fe2455eab504", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700489491, "uuid": "6ba13a0b-f0de-4b29-9959-63243e3ae53c", "comment": "Malware payload", "value": "d451e565ec848d6fb1e5562c2a50ab4fb06d6a4f", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700489491, "uuid": "6db095a8-0075-4921-91db-4df55a220839", "comment": "Malware payload", "value": "914aff97789b5d0a3a0310ce413ddfe51dcb1c057415a6c6258fda50dc5e7275dc675ffd86d5ac3237f244d70357cbb6", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700489491, "uuid": "bb8a6436-0496-4a84-9108-81dbedc52a08", "value": "T12753F7ADC9C102392A623FAFAE0955138CBC4C1B123945FDA679C7DD109385F877E2B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700489491, "uuid": "14007b2a-33f5-4b10-b6e2-31959b84ce7a", "value": "768:efTBMY0EFQXNaY7jwox9F40IZZKlWD7v/IJRxQzPho+Qz0eNgzTMTH6cmJ:e24Yf/xn40IZZGWDsxKPgzuTMecmJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700489491, "uuid": "3c215791-452e-4692-946e-151d9e3e9a1e", "value": 64935, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700489491, "uuid": "f80c7f3c-0dc7-4de2-8793-f4c0e0a9a7f6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700489491, "uuid": "7b996a75-6e99-4dee-9230-bab535f9cc46", "value": "SOA_settlement_order_remittance_invoice_19_11_20230000000000000000000000000_2023.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00077392-87c3-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700498208, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700498208, "uuid": "810e2408-b923-4687-930b-989d67778ff9", "comment": "Malware payload", "value": "80fcd73caa1c90aa0d5e12b943e0e770", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700498208, "uuid": "dd0ac499-0fc2-42fc-a492-a4b7596481c0", "comment": "Malware payload", "value": "82612c711e5bc0166ffbc610ea6518161e0a132d3b9d1ad941175d4c3d3d093b", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700498208, "uuid": "ef0cb357-4845-4798-a902-a0e15e8ee5ce", "comment": "Malware payload", "value": "91a659ed2b915fd4975d13fea72a7ec00eca4210", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700498208, "uuid": "ac2ca5d4-87b3-4542-8c8e-3afbfceb792d", "comment": "Malware payload", "value": "c5746cab7729b1e232cd9efe8e1c54a0632e3e8f070bfb92e4c5a3252d68f14286bb518c1c5ca409118209da6c8e4c4f", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700498208, "uuid": "f202c17f-6bea-4752-a4ec-b21585d518c2", "value": "T1EC453343D3CC4664C0DDA2D93CA8393A36742777DB16D877B4FB9D94072B928CA49CA2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700498208, "uuid": "dafee8bf-67fb-48b0-8424-2ba6485ebe16", "value": "24576:OeI9MdV6uQXwPkWKYIdx0YAiEAj3dacLjahibTvCU:Ola6uQAPxzILRzyUb/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700498208, "uuid": "e0ba5735-bafe-4873-adaf-f7afe6e3122a", "value": 1171072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700498208, "uuid": "296b5b4f-c46b-4d20-9630-4c180a5ca5a5", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700498208, "uuid": "e2471771-6f59-47d1-80ac-ba37fe8118d4", "value": "24d1848d0f2e35cd5e6db5ee4033067edf5e61f3aa7099bd975d0097ea0a8033.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07bb8a19-87c0-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700496932, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700496932, "uuid": "9a9c67ec-5eb0-4bf3-a239-977552143ed5", "comment": "Malware payload", "value": "3d9df775f379441b3631e8fcc6acf345", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700496932, "uuid": "b1bf1957-a26f-42f4-b144-7627fa076c98", "comment": "Malware payload", "value": "84725bb956c4f619fc93fd564f98047f4e01f953d6d9b4195420c159ba78b656", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700496932, "uuid": "b2c1823c-ac11-4244-b776-a8578585c565", "comment": "Malware payload", "value": "3661a60e03167f76ee605388bac074a17ce7fbf7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700496932, "uuid": "9470c669-50b3-49b5-956f-f7b7f16c14d8", "comment": "Malware payload", "value": "ac2b886882c3cb35684b54204c3ed66ede19f958563eb143a0e250bf4ef8c7d5706c252baf26d64f6e82173b97f6c6b5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700496932, "uuid": "2f8920da-ee92-4301-9b61-46a78d6ef912", "value": "T188E4118061151715CEBD03F698106F690BF6976EBAAEDB75ECE7D08CB742B029900F27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700496932, "uuid": "e2c75d73-9c23-4ba1-858f-919d0f353249", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700496932, "uuid": "15621af1-61d3-4a1f-9f59-e765eedbe83b", "value": "12288:jeQXucvCeAeQseQ1NnDT5l3CLQWFA6+Da8qjF6yz7mW33RC09dzD+TzfaCQUtfOA:je4ucqeAeteAll3C0WFzsa5jF6aBCAdi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700496932, "uuid": "7cab89a7-8f48-4023-a4a4-b08642ef750b", "value": 699904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700496932, "uuid": "44f88b77-e35a-4b00-a6e1-e0913850e35b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700496932, "uuid": "0c7c4a95-7440-4883-a6be-4dff6b6a983d", "value": "SecuriteInfo.com.Win32.PWSX-gen.23453.29374", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd4133a9-8780-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1700469803, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700469803, "uuid": "32629bb6-1990-476b-9522-253135e1deed", "comment": "Malware payload (Formbook)", "value": "84d23a1f6f05ef566b22d3837b0263a3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700469803, "uuid": "c202aeb4-8d95-4ba5-8d46-16e51a660fb2", "comment": "Malware payload (Formbook)", "value": "853f116b6cd80b8d09fa74d7651d41e7ceec09276cede5bf6a26346a756b4915", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700469803, "uuid": "ed40feb1-51c0-4a46-b4ce-5ffa1af4b40b", "comment": "Malware payload (Formbook)", "value": "8d0b874b860d7435d37f44448fcd7fbf8b3fc83f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700469803, "uuid": "a15ea134-7c2f-4ccd-ba80-ade30dde2b7c", "comment": "Malware payload (Formbook)", "value": "727aae1bf9e5c42f7b53b8b9575649538bdc63485f60f48d166129b8a2f2860a05c3886f8930da0bc7cd33b3a28b4781", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700469803, "uuid": "8f5a47c6-dd72-4173-b19a-13274127e90b", "value": "T1D0D42266F2EF9702DC791BF9986525504335E9AF2032EA19ADC3B4CE641AF418E01F73", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700469803, "uuid": "4927c0a2-c698-4138-99e2-41d69d457e4c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700469803, "uuid": "699cfabd-a2e8-40a1-b320-f6e0767c42e9", "value": "12288:cJNuPIuDtRBn0r7VX5hDH2DD7gSC5lYIQhQWgPIuTxZKESlMxSG:IYIMtLMxX5B2Dvh9LhQWWIuTxZLSI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700469803, "uuid": "464cd526-3c5d-459b-b344-2096b610bec2", "value": 655360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700469803, "uuid": "4c3e634f-d7fd-4654-b53b-331f184b0c9b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700469803, "uuid": "e7801320-5205-47ec-9ed5-93c2d17b5dea", "value": "S00989282313413.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cdd40d38-87b1-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1700490822, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700490822, "uuid": "47b0b0ff-da53-4f35-a5c2-16a59873458c", "comment": "Malware payload (AgentTesla)", "value": "8fc0f2641714f0e67e0a7c0b9a736c93", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700490822, "uuid": "8bda648a-6400-48d7-94f8-1b3f6f95cca1", "comment": "Malware payload (AgentTesla)", "value": "864fd318ac33d9788aaaa7ec0414ace672ca381ef2f7d4d878e3e4789c9b8976", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700490822, "uuid": "4474a56a-a88a-4523-b483-b2787f0ef2e9", "comment": "Malware payload (AgentTesla)", "value": "8e9affa0c7dba687dbd559f9ee1cdb86119dd856", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700490822, "uuid": "0965762a-1bc0-4272-bff7-b0c0ea23986e", "comment": "Malware payload (AgentTesla)", "value": "d496fe6bf00f09d34d97a1ffbd05f9c07f10be0566466b330db73d78a244966ccc3484539799644d9c82e070ef38dc78", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700490822, "uuid": "ddd35d83-6c74-4952-8004-5e2b2dd99a64", "value": "T15C05CE85E944A6A1DD68AB706A36CD3542337EEDAC34D41C28CE3E6B3BFB7931025417", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700490822, "uuid": "63b5666a-8cb1-45d0-bb3a-0e168e386c52", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700490822, "uuid": "58497013-f242-4f18-b65a-a667a0f346bd", "value": "12288:QF361h61EWGHNsCyopHGA1imK4ZvpgeTwRhwvgdVgTUA5XqfUyP7r9r/+ppppppp:Q4Y7GtsfooAMmZvpBkMgMH5wUy1q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700490822, "uuid": "89342f41-494f-41a1-bb7b-2e37da5e3466", "value": 858624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700490822, "uuid": "6237e627-9941-47f0-9040-48261e1599ef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700490822, "uuid": "b4dec7a6-75fc-4633-92f3-07be38a92562", "value": "PPAP-EDP F-678605..exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb086635-8768-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1700459437, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700459437, "uuid": "a26f742f-535d-412c-a831-705241f6561c", "comment": "Malware payload (Formbook)", "value": "2b3ff99a43a4c58f922197562099b888", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700459437, "uuid": "1e4f56c5-8694-44c2-8c42-9b8bf2cf26c0", "comment": "Malware payload (Formbook)", "value": "889c9ba7e1d8f960077f5d150377151842bd435aef4485c4c5c78272bff35f9b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700459437, "uuid": "73e45465-eee5-4795-a283-2ecbd204542c", "comment": "Malware payload (Formbook)", "value": "f0819852745da2d9db768919bdc213a325ffe038", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700459437, "uuid": "6bd38512-aff8-45fc-a558-e2c419e4c829", "comment": "Malware payload (Formbook)", "value": "88d5cb50a874015ac80e1304936049ea907b4350fd2fa9eb402e6cd14377f22372da6fb334e946412d25955aca12cede", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700459437, "uuid": "aef84b13-3fde-495f-92f7-be6e04a5686c", "value": "T17B8412815AD209A7E5A149B046F7D684BA305E36555087CB1330FE7FADF26F18C0B36B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700459437, "uuid": "3dc50e9e-b03c-4802-8848-c395a37c8fdf", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700459437, "uuid": "928e4af0-7a96-42c9-9c00-cade89bb1a97", "value": "6144:3BlL/SPtf6YGmm5W6yrHOmnP9+3DrwSpo1VsyqQPqdct9bYac59SfD:x8Unmm5WLjD18aHqGqqnYac59C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700459437, "uuid": "7ddec616-c007-4c51-b937-94806e937beb", "value": 385691, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700459437, "uuid": "78e7ed81-5635-4622-9e54-3d9d0827f752", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700459437, "uuid": "11728d7c-f1c1-433d-b57f-424a7903a155", "value": "Order 4102672345007 BUNKER RFQ Serco Marine Ltd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ef18513-8754-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700450559, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700450559, "uuid": "55584ee0-f71e-4e3e-bbcd-d23d9133adab", "comment": "Malware payload", "value": "5629334d6eab1a1bdd9f4c16a53a52ca", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700450559, "uuid": "0235b2bf-ac8b-4b06-b281-5ba57973f1d5", "comment": "Malware payload", "value": "89805045700b583994290d7d900e79208c2a542d6309b901b5ae470b42b96c06", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700450559, "uuid": "2bd02c95-247a-41c2-a7a4-251140c2a9cb", "comment": "Malware payload", "value": "5781b115363a2c8ae0cadea213b8caa9b4b00e38", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700450559, "uuid": "d932fc5b-e0c8-4e29-9611-6953725112aa", "comment": "Malware payload", "value": "2bb7eac64a0fa6eea509d25a16c5f79b39c6ec6822ee947a13c8967b4e51f896d17368638fec7bb493d7603908aa8245", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700450559, "uuid": "7567864d-901f-42ee-9d44-27fc1cd187b0", "value": "T171146A01B5819031E8B302B78EFE5628563CFD51076969DBB3CC5E5E8B36AE17B30366", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700450559, "uuid": "c0957f16-233c-4e32-9800-7502957a1106", "value": "a29e004de0a420c30a3b8893479fb83c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700450559, "uuid": "2391b7ef-14a6-401a-b0d1-85fe75b3a85c", "value": "3072:Q5JNSbK4JW88FRMRcAZPDvwVVc2yD1rMLm6z+ECaZAC:QF0W88F6bZs+2S1QLJzH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700450559, "uuid": "60d922b0-73e9-43ac-87b9-54ffc34fbf76", "value": 193024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700450559, "uuid": "9b5430e6-55ec-4494-ab12-82df77a51b6b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700450559, "uuid": "326d5504-0d82-48dc-8ff3-f1ee88074fcc", "value": "SecuriteInfo.com.Win32.TrojanX-gen.19108.28065", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e8eeb50-8776-11ee-8907-42010a9c0042", "comment": "Malware payload (njrat)", "timestamp": 1700465376, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700465376, "uuid": "4c23a5a9-7c81-4fbb-a9e0-35957e7a2007", "comment": "Malware payload (njrat)", "value": "1d4b7fcbcff6113f78163cdbbd85f41e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700465376, "uuid": "3e869a5a-d7ad-4723-8a58-d24ca0408ff8", "comment": "Malware payload (njrat)", "value": "8a0e22e51df135b17ef1cbd07b6004960c1e07ac604b2d83dd704141423f49e2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700465376, "uuid": "a8e2b7cb-ccda-4f1d-8583-6c59cc7b074e", "comment": "Malware payload (njrat)", "value": "07a6aa6ea11407235f673deed8c7eb088bf09b3b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700465376, "uuid": "040bec68-3bab-454b-aed8-c2a12a842c58", "comment": "Malware payload (njrat)", "value": "100b7a41aa2de0ef8d2801e05961bb7fbb30480b2eaa480b53d18eaddf9e99f0ddf783570cc89fb5956c288c81beaed4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700465376, "uuid": "dfd5df64-1bc5-48e4-b056-f33febba9f5e", "value": "T12CD583862F88C533E249973AC5E36A2D93E7F40CAA55D2C734E85BB7341A7035D21B1E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700465376, "uuid": "4fd6ab36-1877-4302-933a-e08311689c93", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700465376, "uuid": "393f818e-3f73-4fe7-b4f5-fe144845c6ad", "value": "49152:ZWsTEkwghTKv4jysGUqgCoOtt1JKYOd73luXA:ZFEkwghTKv4jysGUqgCxttK+X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700465376, "uuid": "db4cec1c-3b99-415a-a02d-57817fd6423d", "value": 2798592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700465376, "uuid": "c2ed1867-8a59-4d7d-a924-84f5fd05e48f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700465376, "uuid": "a06fdfbc-1925-44e8-88bb-759c01474794", "value": "FACTURAS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2036636-87e9-11ee-8907-42010a9c0042", "comment": "Malware payload (LummaStealer)", "timestamp": 1700514908, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700514908, "uuid": "5c19c4e1-b740-4f10-b2f8-6a3209be1b6c", "comment": "Malware payload (LummaStealer)", "value": "6c7b96bf80ded4f23f832a8e97160e5e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700514908, "uuid": "fd51aa41-b1a3-473b-a35e-c069ce161c60", "comment": "Malware payload (LummaStealer)", "value": "8abde6cb004603ac65425851e378e3e9ac1d171653ea35121706708b3b53e06c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700514908, "uuid": "172750b9-ac75-4a2c-b3a8-eff4969f5d3f", "comment": "Malware payload (LummaStealer)", "value": "fc8cb0148f789df86d7b4725fa1ccf318619e8f7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700514908, "uuid": "892799ef-6a30-4fde-9a97-23233afe5a54", "comment": "Malware payload (LummaStealer)", "value": "7b2b5fe684b93d441a3206a5d3d1d044f23b2310ff24dddca15287b93d7a6cb55509a0746f3cef03398c3d331b0b45ba", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700514908, "uuid": "0ecdb00e-6e4a-4314-a37e-d47a2177b702", "value": "T1EC452315FFD44072D6B4473108FB57830B3ABEB15878D66A76069E851EB3B84E63232B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700514908, "uuid": "8eed3675-760d-49ec-83ea-0150845d8284", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700514908, "uuid": "69d49b46-7cb4-49be-b099-a2a5f1028452", "value": "24576:GyJiuQv+zRlJQc83BX5x0arRULiPz0Rsi3rs8pN+bPmxKboFOIF2:VMTwmc83BXD0c/DodGTuFO2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700514908, "uuid": "028e25c6-f200-4773-99aa-4a4bf4446dd5", "value": 1199104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700514908, "uuid": "ee4b02fe-fa07-4886-aac6-3ea14b54cd90", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700514908, "uuid": "02234703-2f9d-49a3-9e9b-384771c8a273", "value": "6c7b96bf80ded4f23f832a8e97160e5e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7887fb2-8781-11ee-8907-42010a9c0042", "comment": "Malware payload (RemcosRAT)", "timestamp": 1700470276, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700470276, "uuid": "cadc812b-4727-40bb-9686-8bbb56984318", "comment": "Malware payload (RemcosRAT)", "value": "f171c520dc0c997ac00eeb0f24b93204", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700470276, "uuid": "4a138ef5-4349-412f-bfe8-ee36ff17ea7b", "comment": "Malware payload (RemcosRAT)", "value": "8ac35a49f5c6f659cdfc9177e6fa21d46c4830cdc21b0d29fdef0ec43f78e5d6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700470276, "uuid": "67d2d9ee-0308-45c2-a8fe-7364165cbd29", "comment": "Malware payload (RemcosRAT)", "value": "9bb618df95f2ea3fd1f44a4dc9a77957e1a4dd55", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700470276, "uuid": "92ea25f4-07eb-41af-b073-7cc9c90c71dc", "comment": "Malware payload (RemcosRAT)", "value": "2163c38a7015ae24ad2b2ce4d9f8076125774ad9ea6771aeb9342dbce2e5cf7a4cecc69755ffd6d567733a32a8b6619c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700470276, "uuid": "d0634f97-2f49-4cd9-a778-40226f7d8cce", "value": "T17074231713E2D067D4D3EDF22A765F66C3F7B721B101DA8757501FAB0E7AAC2090A682", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700470276, "uuid": "5e0148c5-f4be-4139-9061-28f43947496e", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700470276, "uuid": "7adf26f7-e513-47b3-b1d6-b13922500ab7", "value": "6144:wBlL/7qmeSvqymNU+qi8gw/vS77KfWUNXTs4KikbJuuZrVK62rfaeBSNmfo:CJJea/mq+qi8gouKfWUNjTGJBR2rfaeW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700470276, "uuid": "d3ead474-7157-41d0-ac99-29aa4d93bc4c", "value": 368917, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700470276, "uuid": "12fc98de-b594-4a3e-ae4d-b0be0d0c7e61", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700470276, "uuid": "50cbad4f-e56a-4ebb-b227-c37d2476fd2f", "value": "FD0986500009009PO.CMD", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40067f24-8794-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700478129, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700478129, "uuid": "43e7b4a5-051e-4e23-8274-1d3017e23e83", "comment": "Malware payload", "value": "162d8d5340719138f22602c9cd745c21", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "vhd", "colour": "#219A84", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700478129, "uuid": "cfe17264-3da8-457c-ae57-739d27869e6c", "comment": "Malware payload", "value": "8b39e9f2f0eae3919c9ddcfe3f4daef88cbf1c9ef3abdcf563e331f080a6ef88", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "vhd", "colour": "#219A84", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700478129, "uuid": "ad83ecf0-6a43-4a7c-ac22-90b1840a9e12", "comment": "Malware payload", "value": "2c3294962f4d93f159c2c69200d88d0851e687d5", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "vhd", "colour": "#219A84", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700478129, "uuid": "2259d9b7-24d3-4cab-a0c2-80b664d30a49", "comment": "Malware payload", "value": "a751583a76b089f260d04c694b1ab98ed5d81ad41946929ee07589d4e5adb382bcde09d1a7ab3234c3e5da55b129f73e", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "vhd", "colour": "#219A84", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700478129, "uuid": "277602dd-1ffa-46e4-97f6-15bce4a8863c", "value": "T15156CF20BAA1C236D8B715B94DBEA39A557EBF702F2451CB72C40EDE0E315D5AE30217", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700478129, "uuid": "c6c567ef-50a5-48d0-88b7-b77871038d54", "value": "49152:t8JYy3j5T+w+X7gJhHcnsZ9UwgV+UjgaibGz:CJYwTf67gHlUBV6Zb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700478129, "uuid": "c5bd475b-df3a-4495-8ae7-f6b5832e191a", "value": 6291968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700478129, "uuid": "b7605dae-323b-4d8a-942f-5356a6c98c31", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700478129, "uuid": "8450b818-be24-41eb-8528-094b2cea5587", "value": "gruppo.vhd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7221dbe-8768-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700459458, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700459458, "uuid": "83ec70b0-9cee-46e3-94dd-0f37002dfc80", "comment": "Malware payload", "value": "9aaa984750da0752680efe95112b8138", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700459458, "uuid": "e1f2f746-d909-4a08-9bae-68abb081938c", "comment": "Malware payload", "value": "8ca5fb996e43a8257aeead6230584228e1de3f34ac57ecf044cfb5135718a942", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700459458, "uuid": "8e63fea4-bbb9-4ee8-8277-3ba7922be973", "comment": "Malware payload", "value": "d627ef0f04de011530a93a7f7c6057b787084c27", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700459458, "uuid": "66744ca7-20af-42ca-ac49-9d86b372cb79", "comment": "Malware payload", "value": "15089b02abb0f17e4777dc6a053a254ec2336847ec530472a4159d3840c5d41384b1781932798d6fc9d1d80ab1118e18", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700459458, "uuid": "091da134-ce4c-4a1a-ba5d-20c2d8dbfcbd", "value": "T11414CF2237E1C032F16745308AB2C5755A37BCA28BB195CF27941B7E4E266D2CBB9317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700459458, "uuid": "e9e0e58e-3c07-4d0c-be9a-589c5e53a951", "value": "225c0a302d7e57a1c8187a7075db5d12", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700459458, "uuid": "f9863abf-9b5b-4eb4-90fd-4341a18ab381", "value": "3072:BCebjxAmN6TIO46oyo82t1jf9qK5g4wpZHXv0s:TjWq6TITPyW5gKWFd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700459458, "uuid": "3750c4af-4906-4c43-b8f3-0f48d3604168", "value": 205824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700459458, "uuid": "81c7d0ac-a41a-4ac2-aacd-2b918cc8b51c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700459458, "uuid": "f767ff1a-6a07-4710-bed1-276a0847e492", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb08d3f0-8777-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1700465880, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700465880, "uuid": "41cf9648-52d6-4c97-813f-40ed7bb811e0", "comment": "Malware payload (Formbook)", "value": "8393871ff4f062e17c80f04cc63264d8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700465880, "uuid": "b66ba83d-5c99-4c20-946d-f0fcd05aa07a", "comment": "Malware payload (Formbook)", "value": "8cc2465b2e089073d955e0813cc68f02bff376fe310834a080c3a7694130d561", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700465880, "uuid": "2473bab6-5c35-4843-8cea-cda1902c5cba", "comment": "Malware payload (Formbook)", "value": "ee964aa4358146dab650763f7ed93c77402c5856", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700465880, "uuid": "64b6ef3b-9e7d-45f8-9bac-843750ba0e45", "comment": "Malware payload (Formbook)", "value": "b6d0046b695ce3df5d3d22570e864de943c0193e8f7aff94a0ba3a5b74a265e752a61efd7d7ce9b1a8c5707b75c2784a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700465880, "uuid": "a0f3dfd9-8c64-44ef-a7c0-f13835be1496", "value": "T1B7842224E7C9C9A3E1E26870D72BC9B9A2B4FC046169770B57903C977D297D673220CE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700465880, "uuid": "414e86d0-c833-4752-ae0c-0f90144cf015", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700465880, "uuid": "0bf534a6-239d-4da3-9a4a-e4ccb3659e17", "value": "12288:xMMNZ2+DkHECLttomgb+B3DehWO944U9NfCraFkW:mM/2qkHE0sRwTehP9ANfCeGW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700465880, "uuid": "b3c86882-6836-425e-881c-64f7bd364d33", "value": 402847, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700465880, "uuid": "d79c6619-49c0-43aa-b08c-c7664217cb92", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700465880, "uuid": "c0338368-f34d-4ac5-9867-250e6459e5da", "value": "NGL3200.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9dab9ff-8770-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1700462871, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700462871, "uuid": "ea747906-9b4f-46be-bee0-e74a76331517", "comment": "Malware payload (AgentTesla)", "value": "a6ac7f8f603331031fcb0e3471095351", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700462871, "uuid": "8b28dc95-2e0f-4bb1-b69b-fdd82683f6d1", "comment": "Malware payload (AgentTesla)", "value": "8d73435308ce02c19cf26a6713478da7f50e989301f53589e66cd54fc25d912a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700462871, "uuid": "d2811577-6d73-4f0f-97f1-bd0c1fb77cae", "comment": "Malware payload (AgentTesla)", "value": "5ee61e2d7cecaacd7af859f7bef330f67d23c1c8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700462871, "uuid": "fa005354-906a-4ebc-ad0d-f495845add78", "comment": "Malware payload (AgentTesla)", "value": "4e7207b18da83fdfa770f6c107bd0e8857318d2636e3339f095acb1b8f8dd3389b5eb524ea4a5c87e003eb6149ed873b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700462871, "uuid": "f88893be-b3fd-43d4-b508-8bf12b7c704b", "value": "T133F4D09C3A4071DFC86BC872D9A92C64AA6174BB570BD207A01716EDDA0DACBDF141F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700462871, "uuid": "d4de80e3-aaa9-42a3-a6e8-05205903ec01", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700462871, "uuid": "2a5ca71a-6a75-4b14-a926-514433231821", "value": "12288:9vUg61h61EWG+rOv1vCLFMpJcOy9tkS/ZJg8BuyObNA8TbAbm/tkX6tLnqafBpvH:NMY7G+rOk2YgWNUJLbAbm/tkX8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700462871, "uuid": "ba0938de-d8c2-4ea2-b5d0-5e78f8eaf4ee", "value": 751104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700462871, "uuid": "74be7a6c-10fe-4055-bdf8-38374bc3add9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700462871, "uuid": "c6eb355b-d9a1-4b86-8cde-1250524aacea", "value": "AWB 2774038374.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92d468ae-8780-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700469678, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700469678, "uuid": "f4478a04-9b47-444a-b9d7-3431ca4e43d3", "comment": "Malware payload", "value": "e07dd493c8b3deed95771108dd33f18b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700469678, "uuid": "e1bc4243-e508-45c9-8b93-a553d8ed0963", "comment": "Malware payload", "value": "8d8505491f358d481b2960072fcd10ae597fd06f9c2dfaefe79756c774dd5958", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700469678, "uuid": "bcafba51-9c3f-4944-bf46-162307ba8553", "comment": "Malware payload", "value": "72fdb45ba60e30cadcc1a9bd0a48ff12d700538b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700469678, "uuid": "5fc82e5f-8792-4407-86ac-44d1b9e00417", "comment": "Malware payload", "value": "79c0f46ad61fa7b53a91a7c63f7554262e0964b122affab28a57900ff2d38ea5c5308a96716f1db19a1b45b036aad426", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700469678, "uuid": "581d4b97-6366-49b1-9a27-49fbfbd4ab87", "value": "T1E2C45F0BBED68EA6D38B1737CDAB04141B7CE8816617D70F298E236F28637739845617", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700469678, "uuid": "66a2e10f-2ee0-4eee-ba28-a0aab95af7a0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700469678, "uuid": "593f739d-bcd1-4b73-bb3f-e97f5da4cea8", "value": "6144:KW5rY1b7BllKT+d9RcDpFcvv6KxC+IOqRQwDtxY/gOjKoF:xwb7BkU9+cjxC+IOqKD/zK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700469678, "uuid": "508328ed-5134-406b-a8bb-ec0da1a8c63a", "value": 567808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700469678, "uuid": "9f06d125-bfda-4aea-b659-2a2488e542b7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700469678, "uuid": "e3af2f88-636b-46a2-b416-af9e92ad8d3e", "value": "Aviso de disponibilidad de Factura Electr\u00f3nica Iberdrola.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89ec499f-8773-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700464080, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700464080, "uuid": "c064f309-da5e-4c23-bf5c-1933b1d0f3dd", "comment": "Malware payload", "value": "81a6fa53d6e25f7de3aeec4770265ee7", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700464080, "uuid": "4854b9ec-30b1-4f2b-ad4b-c3cacb188833", "comment": "Malware payload", "value": "8dcf1769699ed565ca44896bb16611c6cc47329e16f1e64832a19b34850e73f6", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700464080, "uuid": "0919eacd-68a1-4630-8a38-9d68d4066e7e", "comment": "Malware payload", "value": "7ece3d5e1ce4685cf8578b5686e375e3bb98bb30", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700464080, "uuid": "94a6af4a-c741-4540-9a52-5200200fe04f", "comment": "Malware payload", "value": "5f7615f8ae30b524a5e98bdcd072afb0891500b9541622a17ada778195948bce7cf05e2bdf0fce979d59aaa6d7607184", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700464080, "uuid": "b2a45746-c342-4cab-9c63-85bdd14964fc", "value": "T16693AB2DC34B01A9CF224376AB1B1E4542BDB62EF345A2B1346C537433EEC3995662BD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700464080, "uuid": "1da88097-9816-4057-abb1-ae91be72521a", "value": "768:jwAbZSibMX9gRWjl5IaoOAkZ5ZLmYfoVQHNdRNm6xv9GbTh+KiUmq:jwAlRm+aEkZrvfoiNdtv9GhziUmq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700464080, "uuid": "6b8cbf0f-a807-4aa5-ac54-35d9d14a15e5", "value": 94521, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700464080, "uuid": "caa8281c-feaf-463e-92e1-fd78f56924a9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700464080, "uuid": "45bbed0b-1647-4d9a-a3b3-294f545d59ab", "value": "PO#11231270.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "456b4c06-8771-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700463106, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700463106, "uuid": "982c523d-59a7-4c9c-ae0e-5ab09c82bd35", "comment": "Malware payload", "value": "7e9a009322b63b1bca4ffd3b151553e8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700463106, "uuid": "cace2279-f95c-4d4c-ba9e-4701d21d1bf3", "comment": "Malware payload", "value": "8e0a304aa9a032b4c657320a890d26163e54c014386348354afeda0803f02165", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700463106, "uuid": "9c12269f-ff60-44a6-be76-22b1fb19462d", "comment": "Malware payload", "value": "3c843c6e9d0ce6c0a26569daa732afef0eee1f46", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700463106, "uuid": "7dbf2201-6e0a-4e98-924d-72f4d704e84a", "comment": "Malware payload", "value": "c35bf4e0f84b72e7428569df27c697c572720273d9bd8540289aeb4daa16a14a29f5d614bdd196be702de3653f9e99ea", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700463106, "uuid": "a4ab8a2c-4e6e-4e41-a62f-02912ff9631e", "value": "T1B6C33A59A37A8B66C7EF23BAF4F102004F31E4C97522F78B5AA852F519233525F2435B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700463106, "uuid": "e255f697-e195-4aa6-86ff-b9b439fbd742", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700463106, "uuid": "f3fdc391-8358-4a36-a94b-50a691acfef5", "value": "3072:NWpY6oDXvaif4Pd6RYeqh87/ai/5RJX7:01oDXvhf4QKed77RJX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700463106, "uuid": "31d1d35b-1e56-41f0-95be-8041e3c5de3c", "value": 129024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700463106, "uuid": "3cd9fc6b-7d8a-4d48-bb07-50d4a6056c76", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700463106, "uuid": "e1c61387-e8f7-4b8b-a065-9aab0db807a3", "value": "HBL-SO200347X46FHTY_4775BMGGXX.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e6c4f44-8779-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1700466503, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700466503, "uuid": "e26ea285-d7a2-411e-b899-89bf2a2f5ae5", "comment": "Malware payload (AgentTesla)", "value": "b979a1fb3aa9a8164472cd3a9c2c7ecc", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700466503, "uuid": "596d4b9e-0b69-4a25-80c7-ca7d072623c0", "comment": "Malware payload (AgentTesla)", "value": "8e8d8067a54fb765bdb79b9ea1f37dfcd08ea29d6c039dc93c31c8ce6c5f72eb", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700466503, "uuid": "de6a3d70-5611-4cf1-88d4-b972a9715eee", "comment": "Malware payload (AgentTesla)", "value": "a39d9784af9b5ff3bcc8a317aa438d5473ea5a0a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700466503, "uuid": "90f41fb1-61fc-495d-ac69-bc0f26bde5f8", "comment": "Malware payload (AgentTesla)", "value": "1c7595469c2504e965d55414502217b2ea345a7b2ee8be6c6a7f5543cf0533d61e5e7bf03adb8d23560f33add4041136", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700466503, "uuid": "a9e27cc9-b765-4f5e-b296-3102379e6dbe", "value": "T137F402153368592BE92D06F8A46650C04BF2FE12B451E3991DE37BDD2BF37925B032A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700466503, "uuid": "49c904b1-e526-41a4-800d-2d0d3dd7745d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700466503, "uuid": "8bf00d44-2943-4bb4-972a-109dec675ed2", "value": "12288:msDuLlf0r6hqA6ccshvjUeGtXr5LKL+2Q3RV1brAPTY5:fKh3F6cc6Uekr56+nh4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700466503, "uuid": "b54d5076-c31d-4c41-863c-e42b2d78fb97", "value": 736768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700466503, "uuid": "a94a196e-ffde-4716-a006-d095975d8b0d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700466503, "uuid": "633cb6af-8edf-4578-85e1-0bf0fe0cfa66", "value": "TEKL\u0130F TALEB\u0130 VE F\u0130YAT L\u0130STES\u0130_xlsx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b339aa1e-8766-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1700458565, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700458565, "uuid": "9f73cfcb-f90e-4ff6-8c23-011c6304519c", "comment": "Malware payload (Mirai)", "value": "ac0cb68da59c1ce0d1724d9856ad169d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700458565, "uuid": "a49f6cad-811e-48da-8930-f7685d369917", "comment": "Malware payload (Mirai)", "value": "8ebe9370aa56b3fb054542ea86725e8ec3c6c3a74b3f018725bc76f4d51f347e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700458565, "uuid": "77bf78bb-4633-4d26-925b-1d9084cf30e2", "comment": "Malware payload (Mirai)", "value": "8796bcaf214332e6f48185514e9b34edac25952c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700458565, "uuid": "d708842f-01e0-42f2-88c2-7e962a394c22", "comment": "Malware payload (Mirai)", "value": "964e113c52e3aee0b56a880e3784d7424d111efbc677614939dc59b33036086990fcde2f92039b27ea81fe026895676f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700458565, "uuid": "5f9151d3-dce9-4b4d-8424-457dea0555ea", "value": "T1AAE32ADBF800DEFAF80AE33748530906B530B7E145925B372257797BED3A1991863E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700458565, "uuid": "c65e7f55-7968-4363-a2d3-96009e05d11f", "value": "3072:RhRsZJbhrvKj/mCn9DA1wMlmvVrjbi1Lv16Ksy+O5DO:RvsYbnxAllmQLv1Qy+UDO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700458565, "uuid": "5ae98403-4ade-462a-a64d-d9f3a1a0400e", "value": 150464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700458565, "uuid": "699f5571-de2f-4717-a08f-1c55d0e1dfd4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700458565, "uuid": "cec92fac-f7c4-4adf-b9bf-ed60edd2097c", "value": "ac0cb68da59c1ce0d1724d9856ad169d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cdc47238-8788-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1700473213, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700473213, "uuid": "bcd8fbcc-a235-4172-83a7-3bbaa5643889", "comment": "Malware payload (AgentTesla)", "value": "ebf89d3836ad1f5c25511751d2428901", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700473213, "uuid": "1742f86f-1204-4d28-a0b8-47a644f9f018", "comment": "Malware payload (AgentTesla)", "value": "91499b570a98b7fd30a72d921d5bba82bd96918f8ce06532de3ca2362e1d5c35", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700473213, "uuid": "be0f9f56-e59b-413f-b2ef-02f6e6e25bbc", "comment": "Malware payload (AgentTesla)", "value": "a49f663d8519879d414f10b136140687efbf52b0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700473213, "uuid": "88d5c216-9dcc-4a08-8970-5596911280eb", "comment": "Malware payload (AgentTesla)", "value": "98906330932ae370a52401667d2bf05bd36bea90ff01d14ae0b199dfb871e897d43a425481ff218d64d0073319b921e0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700473213, "uuid": "02753460-1b19-4641-a0d2-129a5481857d", "value": "T155E4235830E004F7CAFEA8F62179557007FBB159BC61C96EAD89259DCAD3B8C8702B53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700473213, "uuid": "875e81d3-6994-4c05-9e38-96564ff9a896", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700473213, "uuid": "13bb1a9b-83de-44ce-9477-0b11ebbf9aca", "value": "12288:ho361h61EWGcPFqba5VPL0MuD4raxpsBhKIWQmjxKzf361:hNY7Gcdqba5VQMuDoaxp4Ep", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700473213, "uuid": "c8926e95-0f07-4fb0-a42a-c0dd638f1a15", "value": 658944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700473213, "uuid": "f0b5bdd9-49f1-477e-9703-7f647daff191", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700473213, "uuid": "fce4e342-8df5-4299-bcf4-37e6b7a28535", "value": "QUOTATION.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b79549d7-8768-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700459432, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700459432, "uuid": "f084c8e4-b540-48d4-84b4-050b58cdd07b", "comment": "Malware payload", "value": "4376551f92511fc6ec79a92f7e2e8668", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700459432, "uuid": "64181994-45b6-4908-886f-4c67ceaae5a3", "comment": "Malware payload", "value": "93e9713d7ac67d0a1422fa60ee1c6e37a7a3718e470150a79fe61054e9160077", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700459432, "uuid": "c4d3bf82-a5b1-4a9f-9e0e-b360fc853264", "comment": "Malware payload", "value": "619bc0fb9e3968275959cc3944c26216119d35e7", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700459432, "uuid": "8dbc69cf-c1e4-4f36-a017-345251493aac", "comment": "Malware payload", "value": "e0b8350b078353e4842e88c32b394f019f41dab2f5a427a1eec2fa32998da84ea2585a0661c941dcce83ed2125bb49a3", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700459432, "uuid": "ac547a27-5361-4965-9c73-dbdb019fc08f", "value": "T1DB7423267AD7F37BB742081348E6607BF1B8E1EBD1D45EF50ED671EAA8209781E04B41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700459432, "uuid": "656f77b5-a341-457a-80a1-59b13da89359", "value": "6144:mZ5mqZmvwUoN6jDuQyYpnioyeMNrnEqn+w5NmQ6bfwI1kVr9UmzIh7Vp:mb9FN6j6+nmhzNL6bfwISVr99zIhv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700459432, "uuid": "df4cf2be-6401-4243-ae19-fda7770987ce", "value": 362239, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700459432, "uuid": "15590a13-acb2-4326-ad5f-6187ba2dddb4", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700459432, "uuid": "6727ac99-ee80-42c0-b823-a4bfe1b91b15", "value": "Order 4102672345007 BUNKER RFQ Serco Marine Ltd.cab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ffe652ea-87ba-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700494772, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700494772, "uuid": "f6a91738-532f-4445-b291-456c6e3e7330", "comment": "Malware payload", "value": "837f2bcdc67af34f66c80c348b724c7c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700494772, "uuid": "641d30d8-f78f-4876-856e-d5a650f76502", "comment": "Malware payload", "value": "941628319ae007a5e021bbec8f4fa5ae7d8645d2e4a67e6a254100a444d110c6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700494772, "uuid": "8b878c2e-b485-4348-8c05-172e05996329", "comment": "Malware payload", "value": "44709be1fcab4d8b5ee7f25aa3461102a1136fdf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700494772, "uuid": "883e7b2b-c04b-48a2-96cf-de1ea706d25b", "comment": "Malware payload", "value": "d85d09620befe86d1edae7c169cf3058e5398f4da49370f2f0af1282599e62a66397ad79b52677a76593569a092ef534", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700494772, "uuid": "c66f0a18-43d1-4a51-a062-63fbb55c1bc3", "value": "T176E5BFA2D2F3974CE0DA45366D3463FE67B26812B723E249CE00D615B47D6F78AC4263", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700494772, "uuid": "09a32606-dfda-44b3-a889-fd62ff490470", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700494772, "uuid": "1ca88202-6702-4aa6-ad5c-f23a3651b47a", "value": "49152:vVDJxDIrRnUXbE2I5rm+OUrgdBQBQQhtARWpPeOT42j5OSHXV:dNxhLur1OU6uORW8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700494772, "uuid": "9e291645-613f-4944-ba1e-1f1fca0308b3", "value": 3193344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700494772, "uuid": "b1720237-f902-4310-acbc-dd8130c3531f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700494772, "uuid": "82d763bf-d58e-4616-8770-953ac7facc4b", "value": "rDHLExpress_Kon.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fefbe67b-8790-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700476731, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700476731, "uuid": "646ba546-0253-4953-84d0-5d73d742d88b", "comment": "Malware payload", "value": "0fec59fc91143d58dfe0f0f14d4e5f08", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700476731, "uuid": "8763c9e0-5b67-47eb-865f-e250de66d7e3", "comment": "Malware payload", "value": "94d7bd6201394056c5732fdf0064a2217edd83816f5805ff91b5db0b8f52f7a3", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700476731, "uuid": "639e2622-fdc8-4bd5-8a29-aa1409367f6a", "comment": "Malware payload", "value": "76de24642195a5b6a14281fdbc457bc614916eba", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700476731, "uuid": "156a86a6-d673-4672-b4b5-3e55f6d4c17a", "comment": "Malware payload", "value": "3e2990eabf8b0bd4914502eec954b2ebb5d9ad64d3d76ba076e676533e00c0342f20bbd3c9e6fa2930446711d05ae564", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700476731, "uuid": "9ec87b25-b4a9-4ca0-b4d1-e8c416b15d3f", "value": "T1E9B2BF7468180DE31CEF657B672F90537FDADBE2B0EECAB49ADF58106211B4081ED126", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700476731, "uuid": "1a74f75a-5069-4b10-842f-6bd80eb01e67", "value": "384:Fuv8G5Esgus0/0tW2KPM3Ce5/F7C4sEgGz38dOQIOlkDxDM/5xAUZvqIRyi:gvVUusQrcCe5/F7C4sEzzMMQDlkdQ/7j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700476731, "uuid": "72577002-82b8-485c-9d4b-43b38f555486", "value": 24335, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700476731, "uuid": "1472aa11-87ad-4483-87ae-65bdea30bac8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700476731, "uuid": "d8444c31-e798-4fc0-99bb-fafb99bd6a12", "value": "Play_Audio_Message_46sec.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbd86baa-87a4-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700485316, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700485316, "uuid": "da7ca128-095a-49b5-8545-ba50f997acf4", "comment": "Malware payload", "value": "30533b832f1a3b68cd40f5656be04c33", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700485316, "uuid": "5e31f42b-e3ae-4c3c-88b1-c4b8724b6994", "comment": "Malware payload", "value": "95943a0a35a08fa88362f9562c6c9bddfa9894cfac9085e2f3de9f7dc9bb1de8", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700485316, "uuid": "f705be56-0d38-4b0d-bceb-ac679f5b518f", "comment": "Malware payload", "value": "0c7c8db458c23add3d8eb107592052c1764516b9", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700485316, "uuid": "a42fd3aa-2c26-4626-9b7e-72a022b6b4ff", "comment": "Malware payload", "value": "8c6f70c8730f5970d8f0b95551197434cc23e9c58617c99312d7db1f5ca56bcd44ffde78c06c111032c6ab4f62848c6b", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700485316, "uuid": "fd12172c-e802-416d-a8c4-99df4792ba29", "value": "T17B5533BCF4BF5D1DED5C0279B2E89581A84791281F2915D01F9CF5AEC88AA6DE0CD833", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700485316, "uuid": "1bc7170b-9cb5-43b4-a50e-39d6b9e00099", "value": "24576:TCm4dsyAwxjK9kh1lgPY38Pw7gGlrsfwnxQLube+SJeBnB2ejN8EJ1:TedxfxjK4I8UWgksfKzSJeBB2ejNV1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700485316, "uuid": "b8bde54f-beda-4ac4-affb-1f402bc973ad", "value": 1316516, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700485316, "uuid": "9cb5f7b9-aae3-437a-a96e-c5faee9e3a3f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700485316, "uuid": "a30a4a7a-eb2c-41fd-b44d-ff5ec6327190", "value": "entrate.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4eb28a85-874c-11ee-8907-42010a9c0042", "comment": "Malware payload (IRATA)", "timestamp": 1700447230, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700447230, "uuid": "5a76d903-cb58-40f3-a234-1929ec900b3b", "comment": "Malware payload (IRATA)", "value": "45d298d77388b0ed1c4e8c3a606372b4", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700447230, "uuid": "82e39e86-8cb5-4aa9-b1cf-43cfd00384c4", "comment": "Malware payload (IRATA)", "value": "973915a73886ef408763d305dbe5751d261f7d8830052e41b531967822296537", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700447230, "uuid": "67f05afd-aba0-4e98-ab6f-db7d3e656daa", "comment": "Malware payload (IRATA)", "value": "df9599892c9c5d675de4d0779ff7bc996bb15764", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700447230, "uuid": "266be1f7-6e46-41e2-8374-dd1b733c521a", "comment": "Malware payload (IRATA)", "value": "65e5ffd21c11ef635fd431a969226031f34ae35b0c5ce1eaeb1b31d13c1dddb29908e884e21395c9ccbaff29091d9f07", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700447230, "uuid": "cdedc329-20bb-44fd-983a-6084808e0f79", "value": "T1A716CF97F395996BC4F39372817513A5428B4C228F83ABC76D24777C28BB5C42E49BC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700447230, "uuid": "63528b94-8444-4659-bcf7-c78f4dbda551", "value": "98304:OcdrPUBfjygLCr8MkLtci79c8WdLqyXgDBws:OcdPSj4k5FhcLdJQVx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700447230, "uuid": "7075743d-35b6-48b0-bffb-8ef7114a74cc", "value": 4256482, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700447230, "uuid": "e91ca908-b0ab-4cc6-95cd-9a260f5e66de", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700447230, "uuid": "09e44691-1c2d-4034-99d3-83346943799f", "value": "saham.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d68d8c30-879e-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700482676, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700482676, "uuid": "55e9e651-6c13-42c4-9a3f-21f1761e7c43", "comment": "Malware payload", "value": "46b35c1c548901878db9420c8beff9b6", "object_relation": "md5", "Tag": [ { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700482676, "uuid": "3259244d-ee6a-4117-802b-85236922d6c1", "comment": "Malware payload", "value": "97916efd2179d02a18871d70c38f0510248c59a62a19b1e81594318db7960585", "object_relation": "sha256", "Tag": [ { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700482676, "uuid": "f03776b0-d874-48d9-9e94-d5254d9c4d36", "comment": "Malware payload", "value": "a88bbf8af3ea73049a5fe8a7a3b4aa3efcd3e8a0", "object_relation": "sha1", "Tag": [ { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700482676, "uuid": "64fbc6f8-0f61-49d2-b951-a064b51ab850", "comment": "Malware payload", "value": "1536be4dab6b94c69a829944e085cc3e4ca259dec8608802075a248b62d29837322acd3f10e23914db9e931a7ff24938", "object_relation": "sha3-384", "Tag": [ { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700482676, "uuid": "848b2512-dfcf-4098-9a42-320922abdf11", "value": "T125B4238C02766ACAB5EFCAD977584654A48244FABB3513CEC8C0C235A170FD2F967C79", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700482676, "uuid": "e09327e0-e181-4168-acfa-6dcc4c204a6b", "value": "12288:Tkc7uNKDmsnnHnkcGpYD29YB42TzcSp7oe5NAgj+gkYLB8e:T6YEBpYD244eckjggIYLie", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700482676, "uuid": "555d11ec-325e-48e1-94ba-ca5c5c5a354d", "value": 500028, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700482676, "uuid": "42f853f2-27cc-4261-802a-54a21a4251d9", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700482676, "uuid": "c05727a2-a9c7-48ed-aeac-384a5d47e697", "value": "Request for 500kg Fertilizer.pdf.arj", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "183f50f1-87db-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700508556, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700508556, "uuid": "58d8582a-b18c-44ad-8863-9c29cfb10ed5", "comment": "Malware payload", "value": "f770853e30f4fa6c746bc55b45727778", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700508556, "uuid": "1148e998-e04f-4032-bd47-a8db057d2f75", "comment": "Malware payload", "value": "98b1f3033ba2cb8118d8a4b6d8be220a4a35912296d8c08cd18e6fd54b9b3ab8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700508556, "uuid": "f81b299e-41ca-4732-a448-5e0579ae91a7", "comment": "Malware payload", "value": "1fbfa79e54f866991347e99e869e9ff85618e195", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700508556, "uuid": "c0ce8fef-bc68-4ddc-bad8-a2885a9e7d0a", "comment": "Malware payload", "value": "3c446eff4240ed0051fbfbed7c37cc2f38e03c93cd958b1c6808befda1c84504ee10412346d6ca0446054dde523dfd54", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700508556, "uuid": "1e4af163-311b-416d-8257-6aad41c20f3a", "value": "T1D46623A3436A0111E1E68C37CA277ED131F703AACF83BCBD6AC66CC124925E5B752957", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700508556, "uuid": "a126eea7-6e3d-4103-b794-db11039fabc7", "value": "372c5d18d541bfb9581c443bc011eecb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700508556, "uuid": "2330f443-7a0b-40c6-87b9-2cf5f2d84561", "value": "196608:WP4Bmey2mcJ4RD5de46H61jHkp/+xp6SPuAe:WP4oRcWD5Y46H8TC+37PuAe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700508556, "uuid": "0df8bd26-db2e-45de-ba5c-194e5e7a3398", "value": 6725512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700508556, "uuid": "1100a9c3-283b-4d24-88bc-c05dea3dee11", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700508556, "uuid": "cf413205-3876-4710-8756-3f44442679de", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d2aeca6-87af-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1700489855, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700489855, "uuid": "23c55320-91b7-4191-94e8-9d36ea0a8f61", "comment": "Malware payload (AgentTesla)", "value": "41be0c94f6de187a0e29e5ac35716feb", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700489855, "uuid": "3ef024fc-33a2-4a0b-8508-37a3d7c69cdc", "comment": "Malware payload (AgentTesla)", "value": "9928ab1dc80e716442ef84dbf93c5141423990f6f011f7efe8626ebe76ba1a2e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700489855, "uuid": "28d25125-a7d6-4395-a6fb-b41f42da2d71", "comment": "Malware payload (AgentTesla)", "value": "d76ff36778f056b6751a9d8c527eefba2483fd20", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700489855, "uuid": "210378a0-08ba-4e51-aaed-41a97a902858", "comment": "Malware payload (AgentTesla)", "value": "63c295c31ca9b2484f744824cc4ebd1f855fb34c6964e38c7eafd31b2294f23f293f8fb010c9f7a8b8e0f622f91a945e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700489855, "uuid": "9d3ee0f2-74a9-4ce3-a185-f76c2f55560c", "value": "T16205E53D1B9E0667FC79D6A7EFE08127B161AAE3F118DE24D8D703965302A0274D427E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700489855, "uuid": "24f4ac9f-3e34-418f-9547-427ffd63670f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700489855, "uuid": "356050f5-eed8-45c8-97fc-587c29150ba8", "value": "12288:3+v/DBa/mFiTEJ0+0OR8FCkoZrGl/gMMlh6TaYKGUi7kAkd4Vb/1J3L4S6aetTS3:3OX8e3KaYKVi7Tb//561u3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700489855, "uuid": "62a23fcb-2f33-467c-af9a-bdf288581b5a", "value": 851456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700489855, "uuid": "c7e1b692-4061-4b8a-a9a1-6929654cd4d4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700489855, "uuid": "d3169600-269e-461e-b712-c89102d5e42c", "value": "rBANKSTATEMENTSOFACCOUNT(S).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f7de95e-878f-11ee-8907-42010a9c0042", "comment": "Malware payload (RemcosRAT)", "timestamp": 1700475900, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700475900, "uuid": "7bfad4a8-1d8b-4e7a-989e-e21f20e29a1e", "comment": "Malware payload (RemcosRAT)", "value": "51e53d5807ba2350d5bbc4147d0bfbf7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700475900, "uuid": "71418fbb-8195-4d7b-aede-98ecc6800e7b", "comment": "Malware payload (RemcosRAT)", "value": "99eadd8817813c922ba8f02cf317a951b4d0338c056068561dad12a73967d491", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700475900, "uuid": "d0e0732e-3fc3-4f51-981b-9cd7cfc8f197", "comment": "Malware payload (RemcosRAT)", "value": "152108441b8565e0845cd6a00f9fa664326378b7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700475900, "uuid": "e76837b0-defe-4264-9e4d-29285ab7ce14", "comment": "Malware payload (RemcosRAT)", "value": "5c9f769e105604de78c144ae484f71e17cc1cc9fee858e02cabb925bdbd9306c93b0cd8599a89adf14ed98c44b46daec", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700475900, "uuid": "060c3176-4cbd-4abd-85d9-8f983238baa9", "value": "T1947402567774C006CBB94BF04CD6E92266B4ED310DA5971B33A0238DA13A2CF8D9D7B6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700475900, "uuid": "a51f88d5-9305-4ee4-b820-12cf114a57f6", "value": "4ea4df5d94204fc550be1874e1b77ea7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700475900, "uuid": "0e073b02-67cf-400a-8daa-9fe47b9eaa9f", "value": "6144:iwq3NpKn65JD9VtK6ktIQx08D/edzq8xZAQgMOD2WKnCMaY82w6/aPP31:ize65JDbxQhD8q8xiKW0w2viF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700475900, "uuid": "c9f3d616-c1cb-4f1c-b65d-b217e3bfb42b", "value": 359686, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700475900, "uuid": "c07e4203-ffb3-4a3a-8f14-d9b410d7e3ad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700475900, "uuid": "0f0e0cda-92dd-4b93-b19e-991b2c8f3ba8", "value": "Yttriferous.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f119ee0-873c-11ee-8907-42010a9c0042", "comment": "Malware payload (RiseProStealer)", "timestamp": 1700440466, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700440466, "uuid": "89d45146-1eaf-450b-8a46-22fe8af15aa1", "comment": "Malware payload (RiseProStealer)", "value": "afcf956da70cd8955d2cab813b790b91", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700440466, "uuid": "21076d0b-928c-47c2-b6a6-abe159c4bc19", "comment": "Malware payload (RiseProStealer)", "value": "9a3ce3e7e403d1411ddb7ffda75659d556116be2c8e7a91f6e7155749830b93d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700440466, "uuid": "08ab2cf9-f8ec-4c11-82d5-38ece3a5258c", "comment": "Malware payload (RiseProStealer)", "value": "9dc9d99f1185ab48ea23b6b5b69cd9d60035eeed", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700440466, "uuid": "a4a68696-a43e-4821-a644-1b41e8b0945c", "comment": "Malware payload (RiseProStealer)", "value": "726bcb335d7f1716ef3ab1237a91079aafe7e49f1d2992e66d7be42f583b824c651ef2d836c9339a1babd5e0123efb51", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700440466, "uuid": "c089a9cc-ad1d-4df2-a521-3e01008da39a", "value": "T160559E71B502D037E1A101F5A67D9BA612A9BA301BAB08D7B3C05E3D95F2DC36235F27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700440466, "uuid": "df7559b0-f5d7-4ba5-abdc-74cbb3cf23a6", "value": "7482a1595744a3c77ac9461f3f27a729", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700440466, "uuid": "89f5df29-7d74-4af1-8cc3-842e5d004ba1", "value": "24576:NmmEs2wqfcRBxJCBEmAMpCOJMbgp2kvB1Pj5R+d3ThJgrU35Zln2i6:8dw/IyPxbgp2iB1Pju3TIrK5Zln2i6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700440466, "uuid": "e99e9908-1afe-4bf0-ab19-5e6d15c58f76", "value": 1322320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700440466, "uuid": "7eb252b5-5356-4022-849a-672900fd7f7e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700440466, "uuid": "a2215f8b-90fe-400c-b553-c81ec0d8b6e9", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ef316c0-87af-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700489697, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700489697, "uuid": "d0d67c50-6b3e-41c2-a689-692a96b65edc", "comment": "Malware payload", "value": "1c582ed5ab7f8e5b3cea45bfcc1f7576", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700489697, "uuid": "9c2d4fa4-3e4b-4c10-b958-296bbeba8cd4", "comment": "Malware payload", "value": "9b87ef9f83ee3400dda09bdb01da6ca1d674eddad63691201d12a66a9bc9bd5e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700489697, "uuid": "6e7a3895-85e3-4a9f-a425-72ed5ece2ae7", "comment": "Malware payload", "value": "107589e91f422ca7b56c362052750e785b1ceef8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700489697, "uuid": "4e1143b2-a8d2-4b78-b872-44c54a10be94", "comment": "Malware payload", "value": "865c600b9e9829fc0b2a3952dfb4d4ea75a03825252b73874bbf9f5871716653008fbf75c46be6ec77fd2b6572e127d2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700489697, "uuid": "bce15f4a-0120-4714-bb50-0110a5bfe6b5", "value": "T19DA412052BA1D447EE611F35A8773766977BDCA82D75860FBB0071823F3B386A039369", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700489697, "uuid": "6485c9c3-9ca4-4851-94a4-b75083487417", "value": "1f23f452093b5c1ff091a2f9fb4fa3e9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700489697, "uuid": "8df1721b-5e61-4c75-a21c-2a30ac7b8740", "value": "12288:+qjLPd38RfvU9ETy5F3AfQZvFYyjFd2ALN:++SU9ETy5NAfQAuFdlLN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700489697, "uuid": "55fcb327-2a37-42d4-8971-15a2d480bc2e", "value": 480488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700489697, "uuid": "aa02b6f7-a733-451c-9d8a-df986f599dfd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700489697, "uuid": "cf86e79e-7595-4c4c-9781-2019f69b069c", "value": "Strae.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8cc940fc-8787-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1700472674, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700472674, "uuid": "1ea1fa8f-e560-4587-9cd3-49555b4903e9", "comment": "Malware payload (AgentTesla)", "value": "e21b61cbcddca535a96fe74fb6c3d031", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700472674, "uuid": "fe92c411-0756-47b2-8a99-3c8022718535", "comment": "Malware payload (AgentTesla)", "value": "9c93e906ef77ff523e6101462ace5f103701a44184be8b1a75e25ea591ab8ee7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700472674, "uuid": "2c54096d-3a51-421f-b898-31de5d3e1957", "comment": "Malware payload (AgentTesla)", "value": "9ef8001bd21dccabf7a5d5fe95468a856a8e4078", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700472674, "uuid": "2942abd3-eb85-4749-873e-6ba1d0f32a6a", "comment": "Malware payload (AgentTesla)", "value": "837017ebadf078a3a38c1caa8412eb8fd0ff80b568c13aeb327748ca4dac51b2f4243982cb6a7beeadd4f965360d7d34", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700472674, "uuid": "b84049a0-0502-4460-b5c4-bd01a1cc7433", "value": "T112E4239235D843EFE6AA95F60172B58403B77656EC31EF9C8C9224EC8ADDBC11204B5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700472674, "uuid": "d5b9f58b-0bef-4856-96da-b65b323790c3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700472674, "uuid": "9fcb6e1a-08df-4bbf-bef2-b098e07275d0", "value": "12288:dO361h61EWG445Hl6zYoVrCWAlw5rCjPJRPx06mog/aWSu8S/vlK7DDp5wxOSqdQ:djY7G446zZVrFOw5+jxRPW6moEVB/tSO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700472674, "uuid": "55361c56-dcf3-4e4a-80ee-952e4154ec20", "value": 661504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700472674, "uuid": "d822092e-39a8-46be-af93-2abb5590d518", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700472674, "uuid": "78c08834-250a-4f23-b1e2-fcb28e185bec", "value": "yNioxZLGtliGwzF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09f90c50-87c0-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700496936, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700496936, "uuid": "ee6685e3-7bfc-4464-8456-a1c6763e6b66", "comment": "Malware payload", "value": "1afb1b84e467b2bf9aab0871a57fddb0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700496936, "uuid": "18273d94-974f-4063-98e4-900177c716e6", "comment": "Malware payload", "value": "9ddb624be9c1c696ce7e616dfcb33ccf913eec7fbdb65a26a13302cf2ad6e28e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700496936, "uuid": "2a3a3ec6-447a-4a21-8ad3-71c5379bc86b", "comment": "Malware payload", "value": "221894dc9f7fa240e9ceac2291e45ef4cf607d3e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700496936, "uuid": "6d82b51c-b4a9-4f39-bd9b-8d4101fb3ec7", "comment": "Malware payload", "value": "b680d3d71927a4d966b1c43fdc17644e605206fb2a2d961a4b1a01048a34d62cec4ff00cda78bfc54baee5c7fcffa070", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700496936, "uuid": "5b3a696a-c82d-4177-8522-9d302e809d48", "value": "T1A5D4BF545CEDC53BC822A23165A4FAACFA3F7445F3E6018672A4C72BD2157EE041FD8A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700496936, "uuid": "f998ce9c-9b32-4f64-a079-b2d2daf54d08", "value": "d17de9f3814ffb789ee5b33c17fd22f5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700496936, "uuid": "2a049b7a-9acf-4296-8ee0-c4a2dd83a64e", "value": "12288:a5DJy9KLBCnUC5Zg2VrcaWl/LeoiOcuDsTsbiXl2aZbsQRH7clr:6VyRnz3g2tcv5eoiOcKysbiXzZAQRH7I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700496936, "uuid": "03668adf-e061-47f1-bc29-84134c0558eb", "value": 598076, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700496936, "uuid": "cc9dedf4-5262-40d5-a468-f4d917271fa4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700496936, "uuid": "4e5e2e2f-6188-4955-9df2-30082c4a6058", "value": "SecuriteInfo.com.Win32.CrypterX-gen.2250.17831", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20cf740a-87b4-11ee-8907-42010a9c0042", "comment": "Malware payload (RemcosRAT)", "timestamp": 1700491820, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700491820, "uuid": "8ae9e32b-d131-4c71-ab17-9d5df3e6ee7f", "comment": "Malware payload (RemcosRAT)", "value": "0a1d0f4a278dff187347c1544ab3dc6a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700491820, "uuid": "f3552d6a-33f7-4988-b964-4032e4a59093", "comment": "Malware payload (RemcosRAT)", "value": "9ef9b4a8ab8366ea77b049febf61fd2003aa90b9b38f5c301bff8a60a0feef24", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700491820, "uuid": "3b94bdc8-b282-49d0-93d3-803e337077e6", "comment": "Malware payload (RemcosRAT)", "value": "765e25fcbbdb651ae743dede4a50f10cc672e915", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700491820, "uuid": "d9f677ae-7bd8-4500-981e-c904ed75629f", "comment": "Malware payload (RemcosRAT)", "value": "fbb28caf69acbb8865011f003298849ff6188964598a5725e3a8b4f895a39091882c3e3a7d19436c1982364b6bf08c0e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700491820, "uuid": "202079ed-0ee0-49c9-bb20-9b16a5506726", "value": "T139C4120432E8D66FD15369321E75C6FAD1A0AC029D21A78777E17F7FBA313C9984B182", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700491820, "uuid": "2a54f4b0-5c02-47f7-8c55-4ea1895efac1", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700491820, "uuid": "6fd7959a-969a-422e-aa9f-2f7721ee94f8", "value": "12288:HVzaqD3kmx8ROJVT7WPBL4lbeItG74jdzGa0oiN/uucM/9:1zNDv8kJ57W2lb/GQGv5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700491820, "uuid": "45e017f7-b9ba-4115-939b-4228b9b67ff0", "value": 585728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700491820, "uuid": "2cf428dc-f5c9-4ee9-bc56-9d9b8c3fdd0a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700491820, "uuid": "2c5a754c-1347-4fe4-8163-ca3d73886932", "value": "jurojarem2.1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29f25515-8796-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700478951, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700478951, "uuid": "97596446-3dc2-44ed-9b8d-c4b58baec54c", "comment": "Malware payload", "value": "d2ef42028e16f265fb090c2212ff0b77", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "vhd", "colour": "#219A84", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700478951, "uuid": "28bab52e-2869-4922-9de4-89d98f48dc33", "comment": "Malware payload", "value": "a0a005300a496b58c26c937b0a095cb380a4bdce3b3d7ce2aa9d641bb1f6e806", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "vhd", "colour": "#219A84", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700478951, "uuid": "10649cc8-2779-464e-8f4a-ba5685676801", "comment": "Malware payload", "value": "732925914e8afa37bc23b976b347611b2168b5f9", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "vhd", "colour": "#219A84", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700478951, "uuid": "58a0fa6b-f16c-4b97-b116-4655c4c7b649", "comment": "Malware payload", "value": "a86c942a0e8c9eb4a7de9e557ae574ed2e1f4eb303c4e0eb0023be6f3a6454f77d9ac5d171b08411c84ac9fc77da160e", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "vhd", "colour": "#219A84", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700478951, "uuid": "36f796b4-ed1e-4bb2-acc3-40de904d47f9", "value": "T13356D021B9D0D077DD7306718EAEA22A667DBE70073951CB63D40F292EB05D3AA34763", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700478951, "uuid": "b1975b3c-3c55-45ea-8bac-4f645abd5ab2", "value": "49152:+8JYy3JDtzkvlpYbBTKPiD+Mmp5T+w+X7gJhHcnsZ9Uwg5bGz:jJY2DtzrbtKPiD+MmTTf67gHlUB5b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700478951, "uuid": "94e9697d-69ce-4bfd-8b4c-0d3b887d649b", "value": 6291968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700478951, "uuid": "faeedcc9-ee38-4a99-aa44-6500050a5cdf", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700478951, "uuid": "a52964ab-f1a8-437e-9534-66263fc7dbd2", "value": "rete.vhd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c7c2330-87c5-11ee-8907-42010a9c0042", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1700499276, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700499276, "uuid": "eeaede28-f812-4352-8c46-6f12b190ad68", "comment": "Malware payload (SnakeKeylogger)", "value": "f764395a696a4dd4b3a010d6bc8208ea", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700499276, "uuid": "19f79147-2b49-4d01-bc50-ea16b16a58e1", "comment": "Malware payload (SnakeKeylogger)", "value": "a1d7f17262e1ea8bcc8e1095b93d4203b9007cda54e752205b9358c01cf1c0ed", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700499276, "uuid": "f0386521-cc37-4384-89e2-abec2681b0e7", "comment": "Malware payload (SnakeKeylogger)", "value": "22c55366e50f18902f2a4c3a6237b6fa42b1a744", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700499276, "uuid": "25906118-cad1-4b83-a1f2-a6fd4767024b", "comment": "Malware payload (SnakeKeylogger)", "value": "b2a7be4897d472a6b86a02bcc70842c61d4c54fa1e0c621fd8936c8d5e720b4f03c6beea340f15ee2c76cd8f8651f0f5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700499276, "uuid": "89942922-685d-4f7e-8dea-dab89d7f0c03", "value": "T18CA423A4335553A3F7FC43F6063A260A5BB06A85857DF3B42DF222CB94627414EE2707", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700499276, "uuid": "802c17b3-44d9-4faf-a1f2-1f356fb22810", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700499276, "uuid": "1b2c95a0-61a9-4606-9f73-4e6a72777b9f", "value": "12288:VvCeU1SvZ951WVDFRWFpNRo5e3g7DvV44r96+tGB:VqeU14/OVfWFpHo5N7Dvm4r/tG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700499276, "uuid": "034e59c7-c784-4ed6-8912-40989d9e8f86", "value": 469504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700499276, "uuid": "6d863000-b76d-4bf9-aa85-0fc0e9c96085", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700499276, "uuid": "26d93d28-4083-4c39-9151-b814d0f2966e", "value": "OZJa.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "865126a0-8775-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1700464932, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700464932, "uuid": "0dabe12b-76bd-4a01-b74e-19a25ee7f50b", "comment": "Malware payload (Formbook)", "value": "a5a915c7ce4cf12a3eab4a9fc2430ec6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700464932, "uuid": "f0c702f3-b048-499c-a28a-63854107143f", "comment": "Malware payload (Formbook)", "value": "a4896d0356ab4cc0e13987f3b6ae12f40cb95e9ff8c677e9cf68eeda54438148", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700464932, "uuid": "0857dca1-5710-4a6f-8d4c-22a6bc585700", "comment": "Malware payload (Formbook)", "value": "f027435731dd3713e044d8f65f8ae313690ab2aa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700464932, "uuid": "120c57e9-0145-4968-84e4-192484022b51", "comment": "Malware payload (Formbook)", "value": "35d3c794084aa498d39f0088935d049ba04b1b473ee1c5c09dcc42da10fd67cb7eb2bd1c697b89d3e93cf9a3a7af2271", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700464932, "uuid": "6d6e3e06-c056-4878-a62d-9243edd13336", "value": "T1876423BB70A1C0F7F75A16B04274471BC3A762904431B5BB6BB02FB7AF862C61E19653", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700464932, "uuid": "0657fd7a-a8fa-4593-b94e-805797a9dd73", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700464932, "uuid": "889aef3d-1c59-41fd-acac-291e69bd8200", "value": "6144:wBlL/9wfkrmPq7x6Sy2dfrDv2nqjCHpkjMALXOPSFRcFWzFn:C/UkiAAedfrjjwx+XOUn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700464932, "uuid": "9683e0e6-3dec-48d8-ba81-f2002838ab0f", "value": 336963, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700464932, "uuid": "257b2a50-6f91-4ce2-beb3-c64daf82aa87", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700464932, "uuid": "c8410770-2383-4e95-b11b-2fd05839f5c4", "value": "Statement Pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "236c4995-87c0-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700496979, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700496979, "uuid": "a546a153-d470-4b3d-b8d7-4ba741ea7459", "comment": "Malware payload", "value": "a6753915f302040aa26cb9f13aade7e2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700496979, "uuid": "060e02b1-607c-4abd-8c6c-8d0f37559ba4", "comment": "Malware payload", "value": "a4ebe271dbb5873a96f50cdfa6d864069cd532801541e0942784342bed3e253b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700496979, "uuid": "1072339c-a431-4844-a24f-3ca59b8bcc9c", "comment": "Malware payload", "value": "e67acba1fadf57c36649585d075806bdca9f72bf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700496979, "uuid": "8fc81fdf-93ba-46ff-93a0-d7c0bc2c3e50", "comment": "Malware payload", "value": "ae57e31b474cb7a865bd2cc5346c0e0c2ef64bb0b42b76768d91c4f176b7e23eb9f5e803a36e31036afc871e0c923524", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700496979, "uuid": "bb6e02a5-8ec9-41c1-ac0f-4c04fec2ad2f", "value": "T10114BF2277E1C033F22749344AB2C5A56A37BCE29B6195CF2B940A7E4F316D1CB79316", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700496979, "uuid": "101f385b-a975-4b1d-8326-060aaa50d04a", "value": "befed62489b371bd700680a9a0ba2024", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700496979, "uuid": "17443021-182c-4e9d-98b5-c7cd4c34510b", "value": "3072:obp7HXRSAY9iwOG5ghGGGzoGdfS+3PYTQuNZXvFv9bJ/wFj:IBSN9i/GVndffkQuNX9bJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700496979, "uuid": "d6ebd271-7e7f-402e-b380-a52527e466e5", "value": 205312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700496979, "uuid": "a67b75d7-66ae-4b5b-b212-438e90efb760", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700496979, "uuid": "6cf0a873-e022-4ef5-85d8-7621af325e08", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "746d339e-87b3-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700491531, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700491531, "uuid": "8a1ad531-355f-4db5-b0e0-235f2e83be18", "comment": "Malware payload", "value": "3177f4fffb456bce3d3ffe7a2db298e9", "object_relation": "md5", "Tag": [ { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700491531, "uuid": "e4ed7d49-26ca-484b-8a6b-748dfc7433a5", "comment": "Malware payload", "value": "a56beeb1f013be52d976ca1e38d14c31b9780cedae59922863636b45ebbd1ed7", "object_relation": "sha256", "Tag": [ { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700491531, "uuid": "9e323819-5a30-4a66-94f5-e42805d6fdac", "comment": "Malware payload", "value": "6ce4ef11a7fc27e2686a364c5abede88b92da82e", "object_relation": "sha1", "Tag": [ { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700491531, "uuid": "a1312765-2f6c-49bf-8777-1d369f03239f", "comment": "Malware payload", "value": "8f1b199bbb1c525e319f1e9123abf584a1aa9e013da73e9150dd4b93c88937bdb78df2d61f0ef419435e53ac764e8748", "object_relation": "sha3-384", "Tag": [ { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700491531, "uuid": "9fd044d3-3580-4d21-b7aa-faa2d3ac6ca1", "value": "T1D3D423B10CA1D9E1710FB276607C9DBBFD768FE721EE0502C5B916EC29875824B28E4C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700491531, "uuid": "d9f6ceea-6eab-42f2-9639-a081e314cf9c", "value": "12288:0kiec8jxamnS1imT8LFj8/Nxn4lo1QUXaZZgcr5h3l7Si8mbE/5eP:0vecExsKjIxyE8Zgi5h3Aiuq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700491531, "uuid": "0175dfd4-676e-4ddf-b282-82b150c1e875", "value": 608812, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700491531, "uuid": "acb60b9d-b763-4bbb-962b-fb49e5811ce7", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700491531, "uuid": "a68907a9-9e82-444b-a83e-311e5b30220b", "value": "nContract.r00", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e2fc818-87a9-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700487253, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700487253, "uuid": "00ae7a22-5bd1-43f2-b688-0be61e81cab9", "comment": "Malware payload", "value": "a369d5c3521cc2a4bdccfd1b9608b4d7", "object_relation": "md5", "Tag": [ { "name": "mac", "colour": "#285994", "exportable": true, "hide_tag": false }, { "name": "Mach-O", "colour": "#555AAD", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false }, { "name": "OSX", "colour": "#59E1B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700487253, "uuid": "c1299a0a-a52a-411b-b4d3-97b03ac39a5c", "comment": "Malware payload", "value": "a6fd2f09eb81bf3afc83c4b019f21c63aa89a73239e67d0acdf6c8f4e714f2ba", "object_relation": "sha256", "Tag": [ { "name": "mac", "colour": "#285994", "exportable": true, "hide_tag": false }, { "name": "Mach-O", "colour": "#555AAD", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false }, { "name": "OSX", "colour": "#59E1B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700487253, "uuid": "a8e5cef9-4f69-4510-bc20-b4c3ccce65a6", "comment": "Malware payload", "value": "7f8d2470db53403a4a441048761ead400f2e14fc", "object_relation": "sha1", "Tag": [ { "name": "mac", "colour": "#285994", "exportable": true, "hide_tag": false }, { "name": "Mach-O", "colour": "#555AAD", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false }, { "name": "OSX", "colour": "#59E1B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700487253, "uuid": "3b14e6e7-85eb-4092-979b-b5f82d16a1fa", "comment": "Malware payload", "value": "41097e7c4ce2a699a9abbdf51b2c1e3553835b983b1c67eb09adc80e1ea9cd6f3e1f256f2b3ce322eede3d40d4a2b2bd", "object_relation": "sha3-384", "Tag": [ { "name": "mac", "colour": "#285994", "exportable": true, "hide_tag": false }, { "name": "Mach-O", "colour": "#555AAD", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false }, { "name": "OSX", "colour": "#59E1B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700487253, "uuid": "cb87df33-9aca-460d-b23a-38398e067aa6", "value": "T1F4057D17AAB0852DD4C5D13493AFD7338772F8662B10BE4A27C0BB156F69C90F76A342", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700487253, "uuid": "8ffff6d2-97d4-4165-b21b-ba4c02a098ae", "value": "12288:Ip6cZqnyiIYo/wIqlnAeqm3sK20BQd8SDTcn4XW5nThjuFfBoJa:K0nFIfwnJAeqA3DBtSDT6GW5ThjuFfAa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700487253, "uuid": "c1d1318c-839c-496b-a556-dbe389c4dd6c", "value": 810654, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700487253, "uuid": "eea6eaef-a4aa-4503-b231-abbd4722688a", "value": "application/x-mach-binary", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700487253, "uuid": "673c1186-76bf-4574-b0ce-540e4dbbf288", "value": "135fc266af08a28fc7b2d3e0c2ca92e9611e626cec13fb70b9eaad1278b72793.macho", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c73cd9ed-87aa-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700487805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700487805, "uuid": "dce930e9-550a-425f-b9a1-8142c8b965a9", "comment": "Malware payload", "value": "455db1c91cdd974a3249172bd0b338fe", "object_relation": "md5", "Tag": [ { "name": "mac", "colour": "#285994", "exportable": true, "hide_tag": false }, { "name": "Mach-O", "colour": "#555AAD", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false }, { "name": "OSX", "colour": "#59E1B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700487805, "uuid": "057ee9d0-d957-4140-82b2-870a3dedaf9d", "comment": "Malware payload", "value": "a7bb346838db73301fe16e8f6bf2e0caee397570bc0df184484245a2715fb9f5", "object_relation": "sha256", "Tag": [ { "name": "mac", "colour": "#285994", "exportable": true, "hide_tag": false }, { "name": "Mach-O", "colour": "#555AAD", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false }, { "name": "OSX", "colour": "#59E1B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700487805, "uuid": "0ba17995-1c9c-4adb-a3cd-963ece36e398", "comment": "Malware payload", "value": "66da4a3b01acfba794016ff406bbb4309ac5c55b", "object_relation": "sha1", "Tag": [ { "name": "mac", "colour": "#285994", "exportable": true, "hide_tag": false }, { "name": "Mach-O", "colour": "#555AAD", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false }, { "name": "OSX", "colour": "#59E1B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700487805, "uuid": "f97438ee-b880-4958-8f98-cd6f504362dd", "comment": "Malware payload", "value": "0fcad24a34dad68a6428e8c2356ab27fc46e041adfe3e782c548bedafc63f26b31572c989249e4539c5c9891eba5b5df", "object_relation": "sha3-384", "Tag": [ { "name": "mac", "colour": "#285994", "exportable": true, "hide_tag": false }, { "name": "Mach-O", "colour": "#555AAD", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false }, { "name": "OSX", "colour": "#59E1B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700487805, "uuid": "760b140c-5f86-4839-8098-d90706d8253c", "value": "T127057D17AAB0852DD4C5D13493AFD7338772F8662B10BE4A27C0BB156F69C90F76A342", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700487805, "uuid": "2be6208a-1c40-4e0f-a116-481d366ab9fd", "value": "12288:Ip6cZqnyiIYo/wIqlnAeqm3sK20BQd8SDTcn4XW5nThjuFfBoJA:K0nFIfwnJAeqA3DBtSDT6GW5ThjuFfAA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700487805, "uuid": "bea04fc9-778a-4694-9db5-65c3ef391cc9", "value": 810660, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700487805, "uuid": "e28b8131-c2c4-4496-973d-4982a83e5483", "value": "application/x-mach-binary", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700487805, "uuid": "cd0ada83-9235-47a2-bc7b-5a61890eee40", "value": "135fc266af08a28fc7b2d3e0c2ca92e9611e626cec13fb70b9eaad1278b72793.macho", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73450e69-8760-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1700455881, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700455881, "uuid": "c1913c32-c940-4911-ab6f-0f11bf4afa1e", "comment": "Malware payload (Mirai)", "value": "401366ca95e8492a252714d1c2f63172", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700455881, "uuid": "7ccd824f-2199-4861-8658-9d7a6385e115", "comment": "Malware payload (Mirai)", "value": "a7e3564ead704c9187b74ade5119463b11ba25b09e3462690c3da629b30c6322", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700455881, "uuid": "e7b9f3cb-ff6d-4271-88d6-5ffd589df352", "comment": "Malware payload (Mirai)", "value": "680b566738b55f4f9a4dad5f1c9176eae2054f62", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700455881, "uuid": "94307961-098b-40fb-ba17-bbde5958a695", "comment": "Malware payload (Mirai)", "value": "8f721ba3472a0a0134d8fbceb9f9a7be018080d4c62d1c3b5c2ec25c4f7e8704d9b45136dd92915ed046c1507afcfe49", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700455881, "uuid": "0ee5499c-aab2-4ab1-abf5-5a0679a3d090", "value": "T1AF936CC5F683D4F5E89304B1613AEB339B33F0B92019EA43D7799932ECA1511EA16B5C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700455881, "uuid": "f236d3f3-0b98-4905-9adb-cf8aad0686b6", "value": "1536:xpmWc2AcighsYJ2fJxfcdHH1mSsM8y6Q+gBQ9TnkISGtAd/0xZ:xpmX2riED2frfSHVmL1Q1Q9kVT/0x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700455881, "uuid": "31d30656-edd5-460f-98b2-e1403b1225d9", "value": 89576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700455881, "uuid": "5e83c416-2563-42fb-a5a7-db4af412d378", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700455881, "uuid": "85318d19-0d22-4f4d-a6d5-225a0d5df875", "value": "top1hbt.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a3f31f2-8781-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1700470120, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700470120, "uuid": "d8ac72a5-66f8-4b68-b61d-f9105049e9e3", "comment": "Malware payload (AgentTesla)", "value": "c05c9fb8c87eef62e1a899172a0c895a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700470120, "uuid": "a7842ca7-d7a7-4ac7-af0b-97f87a415c90", "comment": "Malware payload (AgentTesla)", "value": "a93a234aa70ad7677fa94cdbf6115f1db32523cc933370f3e1d73d56eac95439", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700470120, "uuid": "044a8783-07d1-4d5a-8b09-48f79a016a2f", "comment": "Malware payload (AgentTesla)", "value": "d06e16fc3b3ff6080952f61ab6c9be081d439d25", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700470120, "uuid": "1bb729b6-3692-485b-8286-d90c44472d50", "comment": "Malware payload (AgentTesla)", "value": "0e69b0da1909613574bb2ca52febb482142ada8a197a143678498a49c231fcd08ce0116fe48361b0086477aec557221a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700470120, "uuid": "099bf2eb-d380-449a-acf8-7a8af4f4f224", "value": "T121F4BFAD72507AEFC86BCC768D692C64EA2064B7830BD247A017169D9E0DAD7CF141F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700470120, "uuid": "804803e9-aa69-4950-b723-877a1ed6eb3a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700470120, "uuid": "6b8c37fb-301e-4d8e-8111-ff6d56073165", "value": "12288:F/OEuPkLt7p8U0RNfNasMn3yZTIk7u/m8RUcLAwppSJWwbxQluDiSurp:F/OXut7B0QyZTV8FRUcV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700470120, "uuid": "b7153b57-8e11-4261-a051-112ac9c69058", "value": 752128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700470120, "uuid": "76ceb022-c161-45eb-a654-b1d2f756eac8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700470120, "uuid": "db4e9d63-a4c9-4d73-94bd-eaf4f5e20538", "value": "AWB #2774038374.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2422601c-8774-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700464338, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700464338, "uuid": "840f593f-94e9-496a-a008-2e561dd39624", "comment": "Malware payload", "value": "aeb68f698f88108260ca933385e865e9", "object_relation": "md5", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700464338, "uuid": "ebbb5f12-f1cd-4be6-8b73-afd7bf5b36a0", "comment": "Malware payload", "value": "aa37c9834962ef744c594c5dc3c3c29f2636214a883539517ced0543743da548", "object_relation": "sha256", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700464338, "uuid": "46d37709-e1e3-4d8c-bc0d-2722c6afbd45", "comment": "Malware payload", "value": "b37c6404cdd629a94da8c544b36fc2d2feddff2a", "object_relation": "sha1", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700464338, "uuid": "d7e68a0a-7f64-40b4-a69c-a16f9e88503c", "comment": "Malware payload", "value": "7efcd59c759a21bb6d96d645a37d9f32bd334789f4943aeca60c8dc15c7411f187e59ac5e6af455bf77c70836bcd6463", "object_relation": "sha3-384", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700464338, "uuid": "b621457b-70d6-4e16-a59c-1228684c3120", "value": "T11553F248775F851BDC222A3836A836468B3C7C73B551513D7E1432868E82E7633E6DAF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700464338, "uuid": "18de961b-dd9e-4b15-acc5-1475da475255", "value": "1536:ItsdoQoCgFI8+9F1hTKMqi0moxuBHUobrU65bzHQ/Y:ItsdhCI8c19KMH0mgSUobAM/Q/Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700464338, "uuid": "db06ae08-397d-4306-8457-3892ab711b02", "value": 62382, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700464338, "uuid": "9f124954-a1bb-4cd8-a47a-9ab4cab73646", "value": "application/pdf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700464338, "uuid": "daee0308-34f0-4467-a729-14039a88b1db", "value": "proforma invoice.pdf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20c438f3-8782-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1700470346, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700470346, "uuid": "946a0a58-0657-4d30-ba6c-85b7b638e45d", "comment": "Malware payload (Formbook)", "value": "0b18bac6d14d721f77c338c74fbb6a23", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700470346, "uuid": "4ca8923b-cfe1-48ab-9682-a7e0203ddb6e", "comment": "Malware payload (Formbook)", "value": "aa541b6d06b286550d8942185dec32f1217d7b8ae01897bdbebdbdeebdfccf8c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700470346, "uuid": "89c899cd-2372-4435-83fd-8324cb52294d", "comment": "Malware payload (Formbook)", "value": "a058761eb29b4917a911aec166ea2f322b90d505", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700470346, "uuid": "fa165799-f7b8-4861-b5af-678352620529", "comment": "Malware payload (Formbook)", "value": "7abf443695064b33543a73df0794663283a43c9b08a6c0ca5ada4e153b3866a098d656d6ad1e9fb803792b6ff3eb9d01", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700470346, "uuid": "5fb6417a-9137-4aaf-846d-4f51437ad791", "value": "T19605BDF021A4C796D375ABFF286B90305B676D1624B1D3887EBE70C81DA4B834A11E77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700470346, "uuid": "8a491816-d8cb-4c78-bb6e-1eeeb44efd25", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700470346, "uuid": "455a30c8-7188-48f3-aa8b-5d62a7883c4a", "value": "24576:94p1l5bS1SN8jqN6cUW2AnQo1lbgkJaJwuE:Gc1oQPcWPs5HsJu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700470346, "uuid": "90380ebd-1734-4426-af87-42c729b143e9", "value": 828416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700470346, "uuid": "a950b071-4fab-4669-ad1e-decc6b525066", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700470346, "uuid": "6a175158-075c-43f1-8a9a-d033dbfe2d8f", "value": "S00989282313413.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99b614d6-8777-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1700465824, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700465824, "uuid": "f2041ccf-74ff-4580-a865-e71b35f5f295", "comment": "Malware payload (AgentTesla)", "value": "557679b222f383a25bdcb624aebfae86", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700465824, "uuid": "8b986a3c-6282-443f-a148-59119ff7ef6d", "comment": "Malware payload (AgentTesla)", "value": "ab02b96fc0b183a5b44db6b2a8498e70a7a2f3da3684921ddaea67e6ab77aa6d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700465824, "uuid": "b3552b23-e369-4ffb-acc3-718994c4927d", "comment": "Malware payload (AgentTesla)", "value": "e902a966a21d750cad7ba3bbc4ba5aa08115ff00", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700465824, "uuid": "9026f7a0-5a62-4887-b5d9-819cd5dce70c", "comment": "Malware payload (AgentTesla)", "value": "cb90b41aabb9316e40cabd54553cc5b329335ea226d35db3b76b66ee1141a45a2b06978df1622d54a6a61dde9b7ea59e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700465824, "uuid": "c3682e18-632b-4ba5-b38e-01bf8e549b50", "value": "T175D42308B6982B86D6BC8BFA10215564037BE56BF434DBEC6CE036C7165AF981B8075F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700465824, "uuid": "1cfb364d-a51d-45ea-921b-01f8a8585685", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700465824, "uuid": "359a41df-317f-475b-97ad-d6d4ea64c0e5", "value": "12288:+VMcthmJ5mNZAiGPnux6ro24zVViOTahrvQbYli5dkJsiUQPLF/jRvgjnKvKXAFX:ZlPux6UxVYUcliFitDRjRv4KAqS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700465824, "uuid": "5d86a81c-9173-46e9-b15d-7089eaee0025", "value": 645632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700465824, "uuid": "ec1f4602-87fb-496f-b99c-236cd137877f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700465824, "uuid": "c2bcec42-27d2-4d99-ade2-f9dec8f040df", "value": "INVOICE 6843497.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98aa4dd8-8787-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700472694, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700472694, "uuid": "e81a4420-6bdb-4df1-9474-4e51c6e549b4", "comment": "Malware payload", "value": "11cbba3c62d44cd2f91240b131ee27e2", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700472694, "uuid": "8b7cb508-4414-4b7c-a4ea-20e9b77b0f52", "comment": "Malware payload", "value": "ab1a6d657eff3d3eb8927d5dab552f15e8783ae738a604db7630d4356d2b48b9", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700472694, "uuid": "5fac59e3-d784-46f6-bf3e-457ace65880a", "comment": "Malware payload", "value": "c7e6a0917e6dac6f3ac1fa57dc8db0df6cf6a732", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700472694, "uuid": "8c727d84-bf83-42c9-9003-13c540353e7e", "comment": "Malware payload", "value": "7ce2c59ca571ebabe18a39e52b6c89c5e775dc5b12ee60794861fe6dfdfcd2031e8cee1242140b1568b0555391fc95ee", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700472694, "uuid": "28d2db9d-2df7-4bbd-8c7e-1a6ddc23115f", "value": "T11E35BFF876047DE6266F576BCA96ACDD13B617238ACBA4CD80A477C305A3375EE02C05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700472694, "uuid": "dc69042b-229d-4303-9a32-e9a8a1282aeb", "value": "24576:xWNoy6FNz2H7RlstFDJhdtwuVqvDr/co6ubxEBUoBFm8WjglCORDIBO8Dm840UNJ:V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700472694, "uuid": "91eeadf2-3852-4e06-95e2-0133101c26fd", "value": 1150415, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700472694, "uuid": "4590ec8c-8cc1-4ea5-a5a8-d2d6748968c4", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700472694, "uuid": "ce243c7b-8fb2-4410-a2b7-3d2ed4f9c16c", "value": "SecuriteInfo.com.Exploit.Rtf.Obfuscated.32.6876.765", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c84bd4d-8781-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700470016, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700470016, "uuid": "969aab43-7394-4f9f-b9f3-0d1fa5a2751b", "comment": "Malware payload", "value": "ff25d64a45439a65dc10e9691506d530", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700470016, "uuid": "5ca18c85-14f2-448a-9d48-519d1325e5a9", "comment": "Malware payload", "value": "ab3012ab243af9076011c8e1f77a49766b10642000ec0320154ce80a98541963", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700470016, "uuid": "3b3ab013-5ca3-492c-a291-6c1526a27b4f", "comment": "Malware payload", "value": "7d5c50bda37f1406afdd158400b7c01f1f20f521", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700470016, "uuid": "426ada0f-a887-4945-81ba-11668bac6715", "comment": "Malware payload", "value": "883272652e8c5dbd356f9c9379b25539afda32c9becce7415dc44b7db484fc9d3aa306879568386a6f3c3831ad96601e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700470016, "uuid": "73bc121b-b8a4-4d76-a332-a93b15087917", "value": "T163C33A55A3B68B16DBFF727AF8E012001F70E9C86062F7879AB844F9190374A5F25367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700470016, "uuid": "2b4d949a-1d1e-4d55-9d57-3f0c720a26a4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700470016, "uuid": "fcea4627-ea08-4062-bc0d-4cf1bcbefeba", "value": "1536:EeaNppZ/2z5/oLXlqMkzJ3GvV4sfWuONkKrLpyeS7VdV/qheBlLGLzMO+kaOVjYq:NWpyRowPM+sfHOIlBJDMYO+895KiQ2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700470016, "uuid": "64b4b950-fdaa-4aa1-be2c-2a9c67f5ce38", "value": 124416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700470016, "uuid": "f7ec0b98-f118-4728-bec0-63409164e1fc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700470016, "uuid": "e1d027ba-8b14-4126-b9e1-4eae3de3d691", "value": "justificante de la operaci\u00f3n.pdf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7431cc0d-8760-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1700455883, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700455883, "uuid": "0df054d1-0a29-48f2-b0b9-127a921d34b8", "comment": "Malware payload (Mirai)", "value": "789649cb5edb58ee05914a910e1be478", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700455883, "uuid": "9506014e-0573-4271-9a2a-d3a36832aeb3", "comment": "Malware payload (Mirai)", "value": "ac11a78275ec2c51e147c44054dfa99035638039fb1fbafe136feb5566aced42", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700455883, "uuid": "9d77ee07-4158-4639-b604-fd6c679f84ba", "comment": "Malware payload (Mirai)", "value": "9bc076f8b7bbf5bea46148fef6d4846a34431dd0", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700455883, "uuid": "b52910f5-66d9-4dc5-b37b-043530c5de38", "comment": "Malware payload (Mirai)", "value": "3a99d234026b9ca796e523f4045649bf8cb1e20498eb9313fcc4473c8f0324ee450d053b24f80e55f77d9e207ba01ae8", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700455883, "uuid": "95242db9-af53-436e-b43e-ddbca9662de3", "value": "T1D804D81AAB550FBBCCAFDD3706E90B1139CC954B22A83B363674D528F54E50B49E3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700455883, "uuid": "a25cb577-50f7-47db-ad4f-eb7e3f8d4f07", "value": "3072:ueEknUx+wX5O2aVR8H3NaMZOTTMJxt9U+7fKbjE:ueEw6+wXSVWdaMATwJHy+uv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700455883, "uuid": "b28760a1-9078-4240-a7f1-db1497bdc7ff", "value": 177860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700455883, "uuid": "f30a9b9d-02e6-42c6-ba92-7aacc6a7fd75", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700455883, "uuid": "1fb15326-1128-478e-86b6-5aa05649bab1", "value": "top1hbt.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2566265-87ad-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700489112, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700489112, "uuid": "b12460b7-808e-45e3-b992-09c3e9170e7f", "comment": "Malware payload", "value": "b8d691a920bad9a68085b3cf2ecd8ae9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700489112, "uuid": "0c4554e1-8042-41d6-99a2-af4d5e4389e5", "comment": "Malware payload", "value": "ac17340565c368ba836b57546e93842800e95b1a5b1b75a64f28b446caec27cd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700489112, "uuid": "0bdde57f-5eba-4d93-a36c-466379daa2e7", "comment": "Malware payload", "value": "52a368f0dea23622ff9303c7e9f5bac4ff19cfa1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700489112, "uuid": "95fb2608-34f1-43ad-91dd-71fdfeb768fd", "comment": "Malware payload", "value": "d4cea32c8179b8b57ee3a5a82f24487308c342b49c1eefcbfdda8aebe731f355c7c7c4af913575fefeb1c92609307a00", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700489112, "uuid": "e8b56c18-b312-460b-8293-5de70864175c", "value": "T1B6943984BD7C28A5EC1DE8F2554F5FB3577B78F6B3A2E388531E6426F488BAB0090544", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700489112, "uuid": "17075702-89f4-46fc-8996-8fa120383cb5", "value": "18a0af6b68c70168e6a0431763ed369b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700489112, "uuid": "dd97102f-2269-4b42-a4fb-60ae7a7f7898", "value": "6144:0a8KAZ43dpdaT22nFfh84fL7suk20UXfRQ1z/tsPEuBZNC6zXLd3RzljwZmw1dcy:n8/U7darwZf7cLT6e3bE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700489112, "uuid": "e8eaee91-264a-43bd-952b-27e0fd307ce8", "value": 417340, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700489112, "uuid": "721850be-295f-49a6-bb3b-b3ace0d12685", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700489112, "uuid": "a52f59c7-aa6f-4925-ab9d-e0532de9b812", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da8d98c4-879e-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700482683, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700482683, "uuid": "73ac86fd-912d-49f8-943e-8433878ee7fb", "comment": "Malware payload", "value": "9c90ab11c3437cd6371fb6cd2c07107a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700482683, "uuid": "31f2addb-88bd-458a-8c2f-a1d1a3864fee", "comment": "Malware payload", "value": "ac3f1194d74f5cc87908936d768285d75e7df2171b653271a59568399b0753de", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700482683, "uuid": "7d5b65d4-f97d-45f6-a4d9-59cdc8fd6242", "comment": "Malware payload", "value": "bd2c71cf17757fe90798a64034f2139545de124e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700482683, "uuid": "0675f94b-b52e-4f50-b22f-5f86fa1f7f91", "comment": "Malware payload", "value": "e1d396bcf14aa92f0bed97e1345769d6858bd3e16a57acdddfb9eb1a99db203a48afcc6ee3c8cf105b71a7a95ec34dc1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700482683, "uuid": "691c375e-ebc2-4d97-b362-b5b8998d9df6", "value": "T117B423223AD56310C044DB7E0D2556052BB05E4FA164DBE83ECB77AE9430B609EBBB36", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700482683, "uuid": "e86ac841-1faa-4246-98f8-3982fa5c2ffd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700482683, "uuid": "d2995af4-fe0c-435f-a810-e231dfd5dafe", "value": "12288:hvCei083WxIJSED+LSU+nT392UwzZvYnLcNF/GZFmGg19pd3w2:hqei0oWSDLUILwzVNFe+Lpdg2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700482683, "uuid": "db84831c-1eda-42d1-83e8-0aa22eb3be29", "value": 512000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700482683, "uuid": "1dab8c71-67b5-4837-9ef5-4d6320366eab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700482683, "uuid": "5d09351f-4742-4f5d-81fb-771c5f0141da", "value": "Request for 500kg Fertilizer.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1123b84-878e-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700475822, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700475822, "uuid": "d8cedcb1-386d-41c5-8f60-d682f653ad25", "comment": "Malware payload", "value": "f80e7ff3e214546c55f4a5e088f4ca33", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700475822, "uuid": "f6d4e06e-d664-4bbe-940a-586cd2a3ffbe", "comment": "Malware payload", "value": "acc0ef72d482fff26f18ae62f5d97b66bb899778cdf022827675800506c99dbd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700475822, "uuid": "e445668e-e6ca-42f2-9389-db9f3102ab02", "comment": "Malware payload", "value": "c07a07dc504587e5ad27ffa7e10f70b7e979eff5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700475822, "uuid": "cd73a917-c41b-46e3-b907-6615b3120b3c", "comment": "Malware payload", "value": "550130e239e4914508be6ec77c63851fed7f07dff62e147eae1b885ec2e9738e184c4e22680377251afba7a595abf7d2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700475822, "uuid": "f2f71b70-3cdb-4097-9c6a-2f8706da9aa8", "value": "T1DA35F159E767ECE9FE66027925711D163F429C0E65E9285C228DFB293C32213409BCFB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700475822, "uuid": "874182d9-9d2c-41dd-91a5-21a1beb9f009", "value": "4ea4df5d94204fc550be1874e1b77ea7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700475822, "uuid": "50cca021-9b9f-48ea-a03b-8b4349bb7dfc", "value": "24576:cFJsWOigpbbf9hpdYzEautXZ1j3vkdDEKAwThNCcctg:UJZQ3fFdYQXVfjM6KAUCc7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700475822, "uuid": "80f8d862-9bf0-47f7-b8d3-eb785a1a7514", "value": 1071040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700475822, "uuid": "91bdc4f6-33a0-4b06-9151-f1e4b054979b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700475822, "uuid": "51f9c6d3-41a2-4399-a8d4-2932ac11b3f5", "value": "TEKL\u0130F TALEP VE F\u0130YAT TEKL\u0130F\u0130 RFQ_PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6163869-87b2-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700491292, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700491292, "uuid": "933f020f-d63d-47fe-82f3-4c28b30e2654", "comment": "Malware payload", "value": "80dbe0c081b21c5cc9b4cb4f7f47973c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700491292, "uuid": "d53a84e3-22f7-41a5-9bee-1f2e5ff39c99", "comment": "Malware payload", "value": "ad0ff0f4795ebf53f4ae25c0599850c10ccd01d92cad74a1b69b0f1c59c24c1c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700491292, "uuid": "9a484466-48a3-4d58-8178-5b5fd246f14d", "comment": "Malware payload", "value": "83641bcdf53c0f4a51f0be2be64b21e69703b3cf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700491292, "uuid": "4f5e1300-1af3-4178-8c6f-ed21ca370300", "comment": "Malware payload", "value": "9fa5577e5b29a53e916677cf9653572a5317a7de99bf92a35eb6af4c587cd5487a8f2a0b969a0c7d20e0fc8ad1b134a2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700491292, "uuid": "b6b5271d-5cb6-4dc4-8813-226faafd3637", "value": "T1C47633B430F14E75C9108370896F17ECB6A2E312EA294A7B1B85C59D7BFE5C3DA5084E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700491292, "uuid": "f62a56c7-1726-44f1-9be3-f42e06f7f9a5", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700491292, "uuid": "436c9771-d8e1-4dd3-b44d-024b36cfd142", "value": "196608:91OAfNkedx0u6RUoV3OIQLV4BamVqlTnQ3NBgZ:3O3edxXmF0IFamVanEaZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700491292, "uuid": "e243fc80-75a2-45ea-be08-bed15e85dec0", "value": 7527067, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700491292, "uuid": "b5a04eae-d99a-4822-ad94-ae819e96476f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700491292, "uuid": "085276c6-e582-4a9d-9f07-fb737e6806ed", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2776daa9-87c8-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700500422, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700500422, "uuid": "75549ae2-5416-4b13-8dfe-15c57cd9318b", "comment": "Malware payload", "value": "e87285cfb0ee9f7291264ff4f12fc777", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700500422, "uuid": "9b8776b1-0b4f-4903-8fe0-6ed801185eca", "comment": "Malware payload", "value": "ad56f4e1da4441bb9630f80211f53f38d863abf7d7b29eb8f10c4f999753869a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700500422, "uuid": "29d171bf-e94c-488c-9bca-c1ceaa3ee06b", "comment": "Malware payload", "value": "32578aaed30806b40f2dd4f49b4d31d11647e41c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700500422, "uuid": "3ac5547f-93a2-48f9-84ce-7ecd22fba517", "comment": "Malware payload", "value": "b98142777047776672e0fe962a6cb57b751386c08dca81af1ebd796e3d7ed1a2f8e8eba1c39281525225be7850b3b8c6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700500422, "uuid": "0e7eb11d-03ea-4c00-87ac-b7fa0e600ebe", "value": "T1BF24BF2267F1C073F62746704AB2C6A55A7B7C614B7199CF2B940A7E0E317C1CBB9316", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700500422, "uuid": "fd03fc64-02c7-4d9a-98a8-8469c2d23aa7", "value": "238e0fa0f52afef2ef7eb9659d95319e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700500422, "uuid": "33c6a1e1-b6d4-447b-a79f-dfdd8ba165b9", "value": "3072:anmUbRBIs7CwOid/I0c0tDM12vpBLLDE7Z4iNFSbvLdj:0HISC/i5/tnXLvEKW8L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700500422, "uuid": "2454087b-ce26-4c76-a078-d251d90b6fe9", "value": 211968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700500422, "uuid": "91de30b3-3893-4b03-9733-381b091408c6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700500422, "uuid": "36871f07-2ab5-46b4-9df4-92d27d1c2ded", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b117a3e1-87dc-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700509242, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700509242, "uuid": "2c4854ad-0b32-4b99-9527-0ed08b9970ee", "comment": "Malware payload", "value": "0bedbb180904af5df75f96498a50f6b9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700509242, "uuid": "fb4b734d-57c4-4b0c-b370-97eb4d1064ff", "comment": "Malware payload", "value": "af0128a11a55602a28195de3ea2bd7d2dda5447861e657588f067e677bef33b6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700509242, "uuid": "e8bb7566-4605-4e22-835b-d385d87857d6", "comment": "Malware payload", "value": "6b264a297d8288218ce7ae4478ea3dc280d6048b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700509242, "uuid": "9ab85768-6a44-4669-9c20-672bb5433286", "comment": "Malware payload", "value": "297cecc87ad5e1f83c285b3d91cd0b9b38857f4c0c36e8773039b604c7bc9b1f8b7ab78ddf54227f904165d6e1951daa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700509242, "uuid": "1b6e8869-3f8b-440d-80ed-261bda4c992f", "value": "T1BC24BF2277E1C073F22746304AB286A55E377C618B7596CF2B844ABE1F326D1CB79316", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700509242, "uuid": "25ef7497-4e45-4a95-aacf-ae054f81f4c4", "value": "238e0fa0f52afef2ef7eb9659d95319e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700509242, "uuid": "daa93396-4f36-4fff-b58e-44cba82d0953", "value": "3072:JmHb1bxs7CwOnw/QNBU0E2DOQWk8m2aaMgpzi9eeE0/KjFrbvN/dk:y9xSC/nw/8UiOQW/egpEptKjZl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700509242, "uuid": "5395f3f5-4109-450c-91f7-12b99857c1b7", "value": 211456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700509242, "uuid": "a779c3bb-38ed-4948-8bfa-d4dfd929db44", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700509242, "uuid": "d79655dc-1b4c-443e-9485-de6a729fb5a2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ae5731f-874b-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700446794, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700446794, "uuid": "1714e2d4-94c4-4e4f-b8a1-e4a712df3988", "comment": "Malware payload", "value": "f645ecc293eafc9632d2ddf3e6f6f82b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700446794, "uuid": "ecac2246-3de3-45e8-8ace-f654047194cb", "comment": "Malware payload", "value": "af6e301e131fa59ba3bfae3288cbc3d1469d429d8986bbcbee5d22116456c98d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700446794, "uuid": "364fb02a-084e-430d-a1d5-1d8e7eb0a4b5", "comment": "Malware payload", "value": "7e53ced2cb421cd89da1168cd5f962c933450bbf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700446794, "uuid": "8351dda4-4e71-42c3-b702-9bbd514e0b98", "comment": "Malware payload", "value": "76c5ab0c4199248a591ae986452e019b295185dff541406493c243dda9df8b531da06c47d7360adc58f8cfef0e02b807", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700446794, "uuid": "478fa6f8-34a0-4293-a6ba-17087b3fa908", "value": "T106146A01B9818031E8B306B74EFE4628963CFD51476969DBB3CC5E5E8B75AE17B30362", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700446794, "uuid": "73dd558f-2848-4cf8-aaa2-df0089b39cac", "value": "a29e004de0a420c30a3b8893479fb83c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700446794, "uuid": "833450a6-0dde-4a61-8a58-85b50f6aa66e", "value": "3072:HjQNSbK4p288FRMRcg9vDPw1p8taHV3sLWjz+EC6wa:HMU288F679Mit+VcLYzv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700446794, "uuid": "c153166b-c3b2-4d95-9dee-5b766816494f", "value": 193024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700446794, "uuid": "03e819e6-93af-4015-b5f9-71e1722f77ef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700446794, "uuid": "8282a59a-4028-4cc7-9750-b88890ad0365", "value": "SecuriteInfo.com.Win32.TrojanX-gen.28606.15818", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0eb62773-8775-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1700464732, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700464732, "uuid": "58316340-cd99-444f-9585-d360775bf511", "comment": "Malware payload (Formbook)", "value": "01c5c52c2bfbba4dd2612bca0456045d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700464732, "uuid": "835c2b28-b6ab-4411-90ac-de0f2fd52be9", "comment": "Malware payload (Formbook)", "value": "af6fe603f93c415dd49f79d49bebb51dbece4997941f97455f025d4b43bf95de", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700464732, "uuid": "cda84419-dceb-4d71-b6f9-3701d6f3793f", "comment": "Malware payload (Formbook)", "value": "fa20a96072d7a6e3908a5585058948a715d754a9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700464732, "uuid": "7abbc889-84c6-406e-8c99-1f828af7ed42", "comment": "Malware payload (Formbook)", "value": "c1f0314b1277e1d38f24e6456b21f71192d9cbe7b8bd873bf5b2788746ddaa4b3855ad4eb37395cd02b89d51d4c33109", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700464732, "uuid": "df69e7f5-98e6-4bdd-bc01-06df980e3352", "value": "T11CD412093BFDE655E97F37B49C3507284731694AA433E7CE4A92855C293AB85CA02F33", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700464732, "uuid": "e13c33b3-774a-40af-9469-0fc92b4685a2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700464732, "uuid": "4fe65c45-f6f6-4548-a3dc-6aeb25a2e1f9", "value": "12288:10VMg/mDhfGrcdgd0mt2Q6iRYMX3bfhJ5x+ulW7mbVoi+ILob/+Ge0NNQ8VE58Sb:1ZhfbmF2ke6bfz5x+/ACiDkRe0NNQwSd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700464732, "uuid": "39995a1c-6bf5-4ed3-b764-5dd110091504", "value": 625664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700464732, "uuid": "bb3cea85-a4f9-4334-aed6-c0cfd4134af8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700464732, "uuid": "e1aece7e-7b40-43c8-8e49-3599e9a62a5d", "value": "S00989282313413.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d58eb4a-874b-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700446798, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700446798, "uuid": "5a30e66c-2a77-4796-9ee6-bb17e164b23b", "comment": "Malware payload", "value": "f85139647033d100296f0add71658ef7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700446798, "uuid": "cbf9f778-fb0d-483c-ba85-daf820fc429d", "comment": "Malware payload", "value": "af7e7e4341c13c0f278abddaf53e09e1ca121cd05dba99503e9e8fe6e7908647", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700446798, "uuid": "801d3bca-2636-4d6c-aecd-3e02e546f867", "comment": "Malware payload", "value": "1e817ef18b32224c74f0808f1dfac71873801b84", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700446798, "uuid": "15aa2c83-eb08-4f0b-bfd2-90cae5a4d04c", "comment": "Malware payload", "value": "941dc6dae1092fed2e1adefd7c4ce6f8a6c7aeef9864729fcb0e01a49839d1807068622f421e29b07529988a7013a4bd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700446798, "uuid": "dbc8fda4-44cc-4c04-84ea-8e302a1a22d8", "value": "T1DD047B113AD0C071D57742314AE9EA7566BDBD724F72AA0B77C80B0E0F74491AB36BA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700446798, "uuid": "364eedf1-515e-4e7e-a835-e4ebe33f3568", "value": "dcb14c7ca3401c4393a09e7699a2e676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700446798, "uuid": "7b5bc04a-103c-4377-b022-671299ba2bff", "value": "3072:3XSVZIEfSIyW5TzAWhI3LIXPNiKDCLbKr+qNixKc8:3XSUQSoEUmAFDcb8j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700446798, "uuid": "977e7a6e-8be5-4b5d-bd3a-8a30edc1b11f", "value": 180224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700446798, "uuid": "d1391692-13aa-48f3-aa27-296649587f43", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700446798, "uuid": "a41284d6-0be7-4258-96e3-303d7b77e596", "value": "SecuriteInfo.com.Win32.MalwareX-gen.1365.22378", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "775532ba-8776-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700465337, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700465337, "uuid": "e4d357f3-e054-4eb7-80ed-6cbe318576b1", "comment": "Malware payload", "value": "286376f6a86823ae9205407e8e8d0c8c", "object_relation": "md5", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700465337, "uuid": "f0b6800d-a0e0-41b1-a656-4c15e675fa9f", "comment": "Malware payload", "value": "afd4c62f561184237e42d10135f7c4e634f18628fdad98ed278e97fd2556ed12", "object_relation": "sha256", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700465337, "uuid": "8ee97010-ab4d-41e2-98bd-0a7ed5a42fba", "comment": "Malware payload", "value": "0bacc55549f3845ccd92b6499691646ba25e83e1", "object_relation": "sha1", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700465337, "uuid": "c6db05a6-c81c-4f86-a3f8-68d21c6746b2", "comment": "Malware payload", "value": "26b65c54766f98ddfaec8cb05c8bc5bc813667133c7656778892d3a347f6a6d831f7c57f28e894f9da833c3977401da6", "object_relation": "sha3-384", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700465337, "uuid": "d13fe0c1-741a-4b2b-bb35-481ff1c59886", "value": "T15972BF6ECC8404ADC30740F894013084F7ED9A6BB2B3B91FA711B659D476A9EDB097EC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700465337, "uuid": "7c746843-6131-4548-be48-a933464935c4", "value": "384:qyX7BaZWCs8PL8wi4OEwH8TIbE91r2fRiJYRvi+b49Fo/:qc7CF5P3DOqnYJcMvfb49FA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700465337, "uuid": "8a9404ae-ce23-476b-8d8c-ae21a4bb61b2", "value": 16437, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700465337, "uuid": "c44d3e79-f541-4127-95d4-7cf6433124e2", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700465337, "uuid": "007fd8a4-3d26-4931-9107-6179d5ba24ea", "value": "AWB.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "757e0936-87af-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1700489815, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700489815, "uuid": "15b8eff9-7d0e-41f8-9bfd-ac3339dcd8d5", "comment": "Malware payload (Formbook)", "value": "8ff01422ae753d4cfd84d9db380a6d34", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700489815, "uuid": "dd0a61fa-5726-41b2-b023-6d999f260165", "comment": "Malware payload (Formbook)", "value": "b02043d8ce3c56a13880b941a0fb79fbaf85c98c31281e3f7b0a61f3cb6f7ee7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700489815, "uuid": "3bcaa69f-6991-4fb2-9fba-a49106539c3d", "comment": "Malware payload (Formbook)", "value": "fd3c304efa5ae191a489c0dbe7d1066319f6144b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700489815, "uuid": "8ab4cd8a-090e-40e0-9129-558e9c1dcbef", "comment": "Malware payload (Formbook)", "value": "8cccffa26cec0ea545dfa0425ffa3e4ecc212521ab45c7a7e05bdb2a7a3c4a9f7855388f1a4cc136703c2d9eca106723", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700489815, "uuid": "32b40a65-2cda-4e68-870f-be46539f3acf", "value": "T10C05F53C1B9E0667FC79D6A7EBE08127B161BAE3F219DD24D8D703965302A0274D427E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700489815, "uuid": "e472b3ed-fac3-4214-9e5c-455f3464e019", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700489815, "uuid": "7f344801-8deb-4ddf-83fb-56c8ecdaf031", "value": "12288:DkHLBa/mFiTEJ0+0OR8FCkoMbIZGvsemHuWJQmfNNOx2vd6Cf3rKvTe+MdW0Q62n:DcyaGvaHuCQuNFlfB+MF2rMrBJwp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700489815, "uuid": "0cf95f5f-bb5e-4355-919b-25a206946238", "value": 859648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700489815, "uuid": "93ede83b-c7f7-4b1b-b825-797a9ba904ed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700489815, "uuid": "05587003-db33-4e4a-a6a9-a8b39f98545d", "value": "D19302431033.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "244de45a-87b2-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700490967, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700490967, "uuid": "1e15803a-e460-4be6-b69e-201b970a951b", "comment": "Malware payload", "value": "2590a948843b1cd52680b1c14d2f4a72", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700490967, "uuid": "b99a3cf0-8734-48de-8f33-c3a3fdd02a87", "comment": "Malware payload", "value": "b06e5c126afe32e73b668f994d68fbe4a682e0ccc97a0f01bcadf5359c74ca35", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700490967, "uuid": "fa6615f2-3406-49d7-a262-482919f1563a", "comment": "Malware payload", "value": "dcef6e92eda03a707d5db8046e5e645ad27f2d5d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700490967, "uuid": "8a62a9f0-52e4-4943-8477-a0ae847e46e0", "comment": "Malware payload", "value": "3d3f5155fa37c32668f6c4c7b7d8b50876024450db2de172436788e3aceac0d0e1096bce4b8266670a83f7c28bd15558", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700490967, "uuid": "39d2cbd7-5c4d-4ee3-9b66-5b1b574459e7", "value": "T10AE56B6579018C22CD6D01F2932E840AEA54C786276DED9D3BDB67CFDB0D2C3B94E186", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700490967, "uuid": "f20b9a3d-0319-4b5a-8023-bc7045f31bc8", "value": "49152:EBMtrjhm612SXLXc5dE3Y/AqrJDCV9X8:/t/PTYHJ49X8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700490967, "uuid": "c81ad734-f5fc-4137-8674-195570d1788e", "value": 3092992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700490967, "uuid": "776046a5-a72a-4ab8-8a77-ba51420efed8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700490967, "uuid": "ba07bdc0-1d7f-4519-9f5c-4161f332ab7a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32608362-877a-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700466939, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700466939, "uuid": "2c666489-e54e-4d1f-8463-6853085fc1b9", "comment": "Malware payload", "value": "6aa1b2ae977bf6ad4d3c1ad814d69b95", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700466939, "uuid": "5752f7f6-8306-48a6-96c7-d3b01294cd2a", "comment": "Malware payload", "value": "b12372f5d425850492ea6994a629f911d22653adf730ae750003d7f188bd43f0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700466939, "uuid": "8ec5774a-bfee-40ab-b21a-971a2d7bf9a7", "comment": "Malware payload", "value": "9560dc54fe314361fa7dce4d980c064a319bbc23", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700466939, "uuid": "fa6d738e-ce63-4240-bde8-227bba72379a", "comment": "Malware payload", "value": "70ec96eb9f4744a59a078140167b0810507fb7d6c2a3ef8dc6fa31c8441354dcf140ba495c072b4d67f1a712725948e0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700466939, "uuid": "30ddab9c-d0ca-4236-aaef-deb31e845031", "value": "T107F423104AC8096AF0493E773171A769C73FD208AB60A91B4F2E97FB4E7535AD7BC184", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700466939, "uuid": "deab24cd-494a-4938-baab-828d80cdcdf8", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700466939, "uuid": "346fb61f-dfa8-4bff-846c-f8c72fd1e51b", "value": "12288:o3HaCcld9onCgWEMg0v0+herdKYjtJlcqOO/T3C1DPfXS+7vF52A21GDS6itERhT:uHa7LonIEMPRh4dKYLltOOr3C1zC+GGp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700466939, "uuid": "ceea67ab-6fea-4b5f-9ba2-86a22f6bea1b", "value": 770762, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700466939, "uuid": "8a9a3195-0ad0-4e16-86f8-6941dfa360f8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700466939, "uuid": "77b0c979-e1db-44d1-ab25-e265c9819f71", "value": "NOV#PROFORMA INVOICE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "125ef3d9-8782-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1700470321, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700470321, "uuid": "d815ada7-6447-4831-8815-c5fd14440ffa", "comment": "Malware payload (AgentTesla)", "value": "01117545c435423593adf192c6361730", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700470321, "uuid": "d25252fc-1a6a-4579-8f77-017a53caafcd", "comment": "Malware payload (AgentTesla)", "value": "b1408013b2aafe2fdfc5a240945fce0d2b784862b8343d8297afbf031d02dd33", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700470321, "uuid": "26602ebc-272a-4984-8f62-0797f89f76d7", "comment": "Malware payload (AgentTesla)", "value": "8bfbf242a8980921ebf82f8a1bd64c9313b9715d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700470321, "uuid": "353f5dc4-e247-49cf-8b3b-1d72cfb2d70c", "comment": "Malware payload (AgentTesla)", "value": "8920e1e72987fcaeebb6c3cce40a9ad2f3d255c8775c25e5524bf9f2288fa0b715c93b36d83e0335d7e4923df72e447c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700470321, "uuid": "a92921a3-7315-4be0-8270-53968875b046", "value": "T16F059D467394CF15CA6F11B6E8A282F50773ED41DC01A7D766C8FEA93DB32A61E1024B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700470321, "uuid": "0e274337-5f0f-4fef-b802-9c7180186d73", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700470321, "uuid": "9622f1b4-51df-43bd-a7ca-83c8db8afb4d", "value": "12288:eiJUgNlYQginsOnNPkoJlVD5aPI7r4krvby:euUgNldnJhFJl/iI7frvby", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700470321, "uuid": "019ae693-8acb-4162-80c2-9af2b0b39a86", "value": 833024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700470321, "uuid": "a512e9c7-c9cc-4b11-8ac7-aa889b54a8f8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700470321, "uuid": "98d35394-068d-486e-8a4a-4f4a11ea633b", "value": "PO OAU_NOVQTRFA00541\u00b7PDF.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c8703ee-87e0-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700510711, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700510711, "uuid": "1ae66fd2-2774-4c45-8b49-bf852a2fefd6", "comment": "Malware payload", "value": "6c835499e8ebade8c55d0614223cfe59", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700510711, "uuid": "cfe72cd5-9a1f-4ca2-9325-256723af24be", "comment": "Malware payload", "value": "b150b158d7dc445c348fffdb721f7c1a10f096482d2826ee455608f2061f6b63", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700510711, "uuid": "26a407a5-d82f-4e8a-a34c-09a3baf1df9e", "comment": "Malware payload", "value": "a0e394623b17662b04d0463680ca483dea121e3a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700510711, "uuid": "25e30a90-98c6-414c-8eb0-7c6517bf53c8", "comment": "Malware payload", "value": "4c6f3ef4fce690d966a315934dde8819aadea8b5b156ea02af0f9acbf3fb7ad59f552028fcdd93c7c8b2842270ed5db6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700510711, "uuid": "5c50eca0-77ee-4c33-aaa7-24f786e153d7", "value": "T17124C02277E1C072F23749705AB286669B3B7CA28B35D5CF1B851A6E4E312D1CF79306", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700510711, "uuid": "e575a5ae-e6fc-4016-ac8a-908d44c6e75d", "value": "238e0fa0f52afef2ef7eb9659d95319e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700510711, "uuid": "10661dfd-fede-433a-80e0-09dbf265b723", "value": "3072:hIzbD9Hs7CwOJ+WnJpId4PcmB4KG8T0itVvtFpbvkdk:YpHSC/JLnwVmnT0itjbk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700510711, "uuid": "c4edec92-6fb1-4f8f-bc36-e4a190e2dad5", "value": 211968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700510711, "uuid": "1873ac5b-3538-4f6b-8aab-dc512edc177d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700510711, "uuid": "0916e69b-c0d2-4e82-b56b-217ac99c0b77", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf36ea8f-87e4-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1700512702, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700512702, "uuid": "8eab4d65-70e0-4250-957e-4b48a0ba5dba", "comment": "Malware payload (Mirai)", "value": "68051b11ca3fddf4c9ab3f71b3960ba5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700512702, "uuid": "0a7575a1-bad5-4abc-a93b-f90c11588a8e", "comment": "Malware payload (Mirai)", "value": "b1a5015113858c08dd0a0257417a12479506aea8056c29b4cd1d68e56087f00d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700512702, "uuid": "2781be7a-76ea-4643-a212-098f8b5d0750", "comment": "Malware payload (Mirai)", "value": "25c7883a9f3b634468f512ba411bb93272922eae", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700512702, "uuid": "e741a12d-b8d5-4a5e-95fd-3812c9416fd5", "comment": "Malware payload (Mirai)", "value": "de38da109081bf799e9eb221e31d2c77407ab6707dfac232a6619e842b66981ac8e0af792ca178b33d897f3e51b1664a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700512702, "uuid": "44ad1266-a44b-4851-8953-37c45c99c93a", "value": "T127530786BC91CA57C5D462BBBA5E42CC332523E8D2DF3213DD216F157B8A82F0D6B641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700512702, "uuid": "80f3354b-4b79-4184-b391-bd7386628173", "value": "1536:Kbke7Me3Wark48sIIJXT18joxUsxd8nR:/eoeox4Xi0xfxd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700512702, "uuid": "07742e23-058c-40c3-9ea4-783d55e3bfad", "value": 63332, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700512702, "uuid": "dd9a676b-23e9-4bc4-bf25-784a337b8cd3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700512702, "uuid": "43a5ac44-a134-417e-8ef3-959fc1b16c46", "value": "68051b11ca3fddf4c9ab3f71b3960ba5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8a27214-874f-11ee-8907-42010a9c0042", "comment": "Malware payload (IRATA)", "timestamp": 1700448803, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700448803, "uuid": "d499d479-6219-4724-966e-23a41ec65b08", "comment": "Malware payload (IRATA)", "value": "87519074d04e8a2e308a57c78bc26a96", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700448803, "uuid": "f16d9052-98fd-4a18-8351-5aa69352b226", "comment": "Malware payload (IRATA)", "value": "b1cf78b086b1611faa31eba09b1e1e4be9fe1d0b48445e961160936c968688b2", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700448803, "uuid": "e5babc8e-d254-43b2-9f75-accc7228a9dd", "comment": "Malware payload (IRATA)", "value": "a6996be48b5b0a516da73352a039861f20b8ccda", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700448803, "uuid": "162d3c4b-086d-4ffb-b7c3-1834bb7251eb", "comment": "Malware payload (IRATA)", "value": "c822203d0bb5a9565946041261148a1d97c9081d7dff3feb19397d5dd39b1f6a0279c31ac0e5ec7c350278f7f5a6e085", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700448803, "uuid": "6185024e-c03f-4bad-a157-953f10cc83fd", "value": "T17EF52343F66B9917C8F5C3B226312A3510365E25DB43B64B241977FA38BBCEC4B826D4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700448803, "uuid": "464f8b01-c636-4d85-a46e-75cb6f448254", "value": "98304:RG1PkkkmXuWaYjApn+XZp2CdVhqSkGQoa+TZnk9CI:RYka+Wr6+X+CfhSoPT2II", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700448803, "uuid": "e886ee93-850b-43f7-8b31-4332516bd769", "value": 3469667, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700448803, "uuid": "fe43a418-fa7b-49ac-abf9-cf97ef898b17", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700448803, "uuid": "cc471887-9445-4768-9045-7282b5d69ecb", "value": "saham.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33d8f2b1-8796-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700478967, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700478967, "uuid": "2bb21ca0-eccf-4717-9cf4-5c7dc3fe52ad", "comment": "Malware payload", "value": "42e23f17c647a4e1ae1c27390120727e", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "config", "colour": "#747DBB", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700478967, "uuid": "26faa416-abfc-4213-82b7-0c700ae6940a", "comment": "Malware payload", "value": "b34314e52215dca5420839e5d93787567f3e6df391a058f77fbbeb50cc546a87", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "config", "colour": "#747DBB", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700478967, "uuid": "423b3752-ae76-47c3-a40a-88c8efaab5b4", "comment": "Malware payload", "value": "c4def6d65ebdbe8b357343bfd405464bbfd71ccc", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "config", "colour": "#747DBB", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700478967, "uuid": "e9f2ae8c-a2e8-4937-820e-9916a36e82d3", "comment": "Malware payload", "value": "894ae3a66594377090bca3a5200de31838533e4f94018e720d6faad6294c4d6319fa65116d256489f5f04758c38cfc12", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "config", "colour": "#747DBB", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700478967, "uuid": "e1aa796f-6559-4777-9ba4-9b67e5bf4343", "value": "T108152354BBCDC269EB3366F216A44084AE7D7511733AF119E951C3A8894CACBDBE331C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700478967, "uuid": "13a63377-41e7-4d96-9579-8e04c4080a92", "value": "24576:bd5hgs+wjCX72wjqJhKI3sxxwVT0rGBn9UQZv4e:R5T+w+X7gJhHcnsZ9Uwge", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700478967, "uuid": "24b25b77-46f8-4019-88f7-24b691564941", "value": 946103, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700478967, "uuid": "4aa4e7b2-e49d-4846-a209-2f399fa22a9f", "value": "image/png", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700478967, "uuid": "4bb08225-f7c7-456e-960b-9a68417d118f", "value": "jouk.mpg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "280df7d9-876b-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700460479, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700460479, "uuid": "da76f007-15b5-43c8-a558-8c0a60fab366", "comment": "Malware payload", "value": "62ecc911ccf529ad1b3d497bc004b9d7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700460479, "uuid": "c8dc8643-eca5-4ef7-bb3e-ea2686968678", "comment": "Malware payload", "value": "b3e19686293cee87b430eda57433ca7e990f3d75d0c311e1a96c75f01ffb23ae", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700460479, "uuid": "af7df8c8-f866-4545-9e7d-c4463e2f3b23", "comment": "Malware payload", "value": "194ea6120c6b5713fc84a0c9741e14a67b08f16d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700460479, "uuid": "efabf8e4-f9a6-43fa-92d3-a7d512628d44", "comment": "Malware payload", "value": "f9d5d73bd6d24c7b358e5d7784a8837a8753e8e3987c5915f65de8fc7d5dded1728566f4399621692e0ed4a525ef101f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700460479, "uuid": "d46e7d60-4384-4f0d-bc18-2b5c26837c87", "value": "T143C2195D3B908166C6EF2BB006B2DB2502F2E10B5A27EB5F4CD844FA6B773C14D819E5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700460479, "uuid": "441fb56d-6797-425b-b9d6-a2abe7fde6f7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700460479, "uuid": "4f54771a-c14b-4f0f-8d7f-9ce3972da3de", "value": "384:vLd6cufEYAA/XgWeyoHzCYe/iBY2OzRLTm3yilqr63+bqtVvGD:Dl8AA/6T5e/gsEVVvGD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700460479, "uuid": "e0b17abc-0634-403a-8bc9-97dbf43bb0d4", "value": 27136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700460479, "uuid": "7f0ce3f3-8395-4199-b20e-5e96409f4f13", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700460479, "uuid": "6aaaa02c-ec5b-4162-b4bc-fa4bc52fa22b", "value": "bREM.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "760550c5-8760-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1700455886, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700455886, "uuid": "00240c2b-de33-43e5-9bbf-0975f567334d", "comment": "Malware payload (Mirai)", "value": "24522ed3400d850b256314500035fce8", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700455886, "uuid": "d9554d3b-f000-4877-acd1-c7c6b3a15714", "comment": "Malware payload (Mirai)", "value": "b4d5e18ce89b366f34a4a257fc63c83c1479e3ca699a47cc504b9c7f6f61d2ef", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700455886, "uuid": "ddf17823-f569-4dc6-93f9-fa2daf3cf36c", "comment": "Malware payload (Mirai)", "value": "2e9f5ebc4a4140b61e204eda04d61d2e341b750d", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700455886, "uuid": "03b9fa38-2f4c-4aca-978f-87eaa357b4b3", "comment": "Malware payload (Mirai)", "value": "dbba0afb82fd8e6e61d8f5f9a422a126c6a6f321d76d7401abd820da12bed039047dd9444e958a5995b68e1fe3adf716", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700455886, "uuid": "d591e15c-c4ba-4126-930b-58ebf23d9c2b", "value": "T16304885E6E228F7DF668873447B78E25976823DA27E1D644E1ACC1101F2039E641FFE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700455886, "uuid": "c4150746-45d4-479c-ad0a-c6332244a459", "value": "1536:Cl2PvnqPvLKQuchMJdDNsCK9H1R8cA2iQembSM+xV7TfF+hPyO0Hb/zrt/Y:CuviwcwZsCK9VRhAX+bShFSP0HbbrlY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700455886, "uuid": "6b8b4085-a184-405a-88b5-628885ea4330", "value": 173796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700455886, "uuid": "5b9cbad3-c1b6-43c1-a10b-0ffc6bb0830b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700455886, "uuid": "938d1e06-4375-4a16-819c-de229b426a66", "value": "top1hbt.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "786d80c8-87c8-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700500557, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700500557, "uuid": "08da83b3-4f69-4bab-8406-192a7af7dbb9", "comment": "Malware payload", "value": "7de41cfbeaa83b01830a4ddfa848c4a2", "object_relation": "md5", "Tag": [ { "name": "WikiLoader", "colour": "#264CCC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700500557, "uuid": "368b5d2a-c474-4e02-a803-b7646d855a8a", "comment": "Malware payload", "value": "b6d39183d106ffcd129541dfa8bed0bae54b61ce406e698be7faff5d779b7c32", "object_relation": "sha256", "Tag": [ { "name": "WikiLoader", "colour": "#264CCC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700500557, "uuid": "2bd0949e-b581-47ad-9f08-a1c3b3ecb00f", "comment": "Malware payload", "value": "e1b242cae4d0ae9129e7885c74b2253af5a5b663", "object_relation": "sha1", "Tag": [ { "name": "WikiLoader", "colour": "#264CCC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700500557, "uuid": "81d9f0fd-bde8-41b6-be3a-09fbd8d0f4f7", "comment": "Malware payload", "value": "cf3fb413570f1c66933317750dc1bbb11909fd7d1e5cfc144b959535482dff87084d64fca8ec4007194330ec224e346f", "object_relation": "sha3-384", "Tag": [ { "name": "WikiLoader", "colour": "#264CCC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700500557, "uuid": "0ffea341-9f17-41e3-a0fd-fd9ce16d58ca", "value": "T175363373BF773945E5C8ED82522ACD523F2A822CB7110B5DB7CBC6219A4E71C816846F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700500557, "uuid": "91526b2c-c658-409b-98ab-5b424d0676e7", "value": "98304:YNGKSGMzXFllrLR0LOM2ehhqTubAeThf98EYcv1or/3:SGf7hmLh6Ty9ThV5fv1orP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700500557, "uuid": "cd88e79f-cba1-499f-a546-73075de9d4f0", "value": 4931758, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700500557, "uuid": "7083cdda-20f6-4b21-baf3-510d25d6dea2", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700500557, "uuid": "31114f6f-9264-4f23-b326-0965d8b97599", "value": "Invoice 202311202975228817.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "746c01b7-878c-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700474781, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700474781, "uuid": "ec604e67-58d2-44e7-8c66-876cee07df10", "comment": "Malware payload", "value": "a94a1e22a66f0571b975cae4ffe925d8", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700474781, "uuid": "b216111b-bffa-406e-8be9-17e52f230c19", "comment": "Malware payload", "value": "b883cee95599a4ae80752b5c3419cd1de7bc9eb64dd6badc40704e457060dfa9", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700474781, "uuid": "a1f2f078-6210-42ec-ab50-340e7bdef9eb", "comment": "Malware payload", "value": "3c554adf5df2688d606b97baae00394151d79f27", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700474781, "uuid": "3942bfd2-4cae-4691-9551-0ada546c2277", "comment": "Malware payload", "value": "46cb3cfe5a1503ca82cadbb79d5110758ff18c6ae06f7784ae69a9cf5cb54e57b5eb43dce880dbd2a998eead13f3c8b6", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700474781, "uuid": "406d402a-2528-4596-a5b0-2b8538b415f7", "value": "T14CD423FA8191909EDC5FAC9AA38BD752278C3FA855F0643CC123A805E97D00FB6C7D54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700474781, "uuid": "ac551111-afaf-424a-9b78-d53916e71b50", "value": "12288:iu2y9rn1Zow4+p7oan3fb5lyeHCHdjFGJyjIVbpu/UgUOcFYU:zT1Zol+Roan3ftMeiHiy8VMUIM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700474781, "uuid": "e1035e9b-3ec0-4bcd-8938-22ddda534655", "value": 608523, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700474781, "uuid": "34b7a593-8928-437d-9c0b-f373f3a0d6b4", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700474781, "uuid": "2983fc42-2949-47c1-8538-018472d85630", "value": "PO 5500427059.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0a7fe87-8762-11ee-8907-42010a9c0042", "comment": "Malware payload (RemcosRAT)", "timestamp": 1700456843, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700456843, "uuid": "cfd93d4a-be02-4dc9-ba1a-47914eb1fde1", "comment": "Malware payload (RemcosRAT)", "value": "e75f765cc60c22c945c2c4f2916ae873", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700456843, "uuid": "76b899ce-d022-4241-992c-865ad2415214", "comment": "Malware payload (RemcosRAT)", "value": "b89393f77680adef67170586ddfd3b759694b20afc9f71ed438f1061b43a1fa7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700456843, "uuid": "55526dae-404f-4f9e-84e3-e4759f1bd5b6", "comment": "Malware payload (RemcosRAT)", "value": "24dee8ac5b363434ee482b14ad6a6d0e3d3ad312", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700456843, "uuid": "e0f30664-c0c5-4a22-a055-e5b71fb321ad", "comment": "Malware payload (RemcosRAT)", "value": "c60f92364b4ea9313c780e64a23fc99f8b17488a9c48ccd304d1aed241f24365287d4279bf900fc174f02a4191a399e4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700456843, "uuid": "6295ae92-3f35-48ff-8701-86d0c9159c14", "value": "T15B3412641722F94AF0E0A0BCD944E9F25AA57C602D8B6F4E43ECFF17F917041E68E166", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700456843, "uuid": "84f3e871-be46-4d95-aea5-a923029b59ba", "value": "bc4f8e98d1041d53dd63bfb91ed10d0a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700456843, "uuid": "e9095138-5cb7-41c0-9cff-afde4db99c98", "value": "3072:YOSI2I7txG68nYrugMZJMfsciIpuKNtrUQlAK3qSjYPS+IAXb3Ixi5eFrgurIlN3:hvG68YrvM80ypnjAedo3qiGUY2ChzI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700456843, "uuid": "9e4af589-c83f-4311-b0e1-6bfcf4b16883", "value": 238592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700456843, "uuid": "b7040e87-968c-4620-bd90-5fb9cfbb3e5e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700456843, "uuid": "b5ed809e-76b2-4329-b757-4bb5e8bfb7e5", "value": "bREI.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ecf20d5a-87d3-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700505477, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700505477, "uuid": "5d5ca8f8-7b5a-4e81-b163-f50cb9080ce3", "comment": "Malware payload", "value": "0f08fb541aeded325e9372b7248002a5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700505477, "uuid": "b5eb941d-dfb2-46c2-86a7-1b17708c72a1", "comment": "Malware payload", "value": "b8cb255809d4f5e9475af6c541604c26021aaf8933a078143c6eef71dbfa77c1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700505477, "uuid": "6226c8dd-8034-4bc2-959b-0157bbacc651", "comment": "Malware payload", "value": "5d4cb78135ee4544d3d81ae974c6f2fabd2e2897", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700505477, "uuid": "0b277268-129d-4423-a4f2-3f436ac23cb7", "comment": "Malware payload", "value": "696620e7403f3b7744b86bc117eb480d351a5dd4f602edec86a4a0ddf94002bb9c1c7507c91bdc042bd5571721069484", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700505477, "uuid": "1d1c3900-0ba8-4d17-b819-dd69eb14a7f8", "value": "T1B924CF2177E1C076F26745704AB2C6A25A37BC618B3196DF3B841B7E4E212C1CB7A787", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700505477, "uuid": "63da1bdb-a068-4079-a22e-f62f161baf93", "value": "238e0fa0f52afef2ef7eb9659d95319e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700505477, "uuid": "b415ce34-52f7-4344-a85b-7abe5e3bd9d8", "value": "3072:WCUb3zCs7CwO0al7j8zqHB7EEjoTUFQTF3bvsdj:gDCSC/0iAevo0QTps", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700505477, "uuid": "be073d3e-51c1-45c3-9ebb-175ccdd1f0a8", "value": 211456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700505477, "uuid": "dc5fe43b-7dba-4d6e-8aee-6793b4992abc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700505477, "uuid": "a36867dd-f194-4e7e-9bc8-0abb00b09484", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "854f1bfa-87b3-11ee-8907-42010a9c0042", "comment": "Malware payload (Loki)", "timestamp": 1700491560, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700491560, "uuid": "2207d767-098e-4762-b567-295d092fa6b7", "comment": "Malware payload (Loki)", "value": "a1f6d8695eb3ea40a59178c930235e76", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700491560, "uuid": "e04ad867-225a-4fce-be36-3f97bac92825", "comment": "Malware payload (Loki)", "value": "b929a79e7f384cfa09b8af478710f6e377b81bfe01ac88716c87b09f11dedb79", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700491560, "uuid": "2b971417-2ae3-4ad5-ad0e-d0d9730ae731", "comment": "Malware payload (Loki)", "value": "ed59df0ace545909708b0c4cc73e94e9cdd373c3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700491560, "uuid": "ccde5a2a-14d4-413a-a32f-d5c605d3ce7c", "comment": "Malware payload (Loki)", "value": "e7413a5c0cd0e0ee3dd41aa7cd561f3c6d918d97876751c7194b73205227ebaacc86000a27f74f6266ae425a7e247592", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700491560, "uuid": "ff1f4205-01fa-4151-ad17-59212247c3dc", "value": "T193E4B13C1B9E0667FCB9D6A7EFE08127B161AAE3F118DD24D8D703965702A0274D427E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700491560, "uuid": "68915900-5477-4a42-9507-29f1f21622dc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700491560, "uuid": "8e12a5e0-3f1d-43f1-839c-1f6e7e97d254", "value": "12288:QbDzBa/mFiTEJ0+0OR8FCko2gFKzhqD35KOfBqmDcE8V57czD9XyjLb7sz:QP8ggzM35KkxcB57Goj/7sz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700491560, "uuid": "7bcbcd6c-4ec1-4423-aefc-de42cadf7cae", "value": 700928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700491560, "uuid": "3cbfe7bb-bdf0-436e-9c7e-5b391e558047", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700491560, "uuid": "bfff3ef0-4985-408c-984a-f5d8e9d32789", "value": "rContractList.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "591a869c-87af-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1700489767, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700489767, "uuid": "0eae45bc-9d48-4956-99e7-1507923844a3", "comment": "Malware payload (Formbook)", "value": "6b2379123b3128fd66a6491a5735f7b8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700489767, "uuid": "b21afd39-5895-4ed9-8840-24c77225b0ce", "comment": "Malware payload (Formbook)", "value": "b937e279fde4541f11647041a467d331dfc78562d9e267a7eab970d62dd017f5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700489767, "uuid": "eecbd44f-358e-4180-b451-c829a6461277", "comment": "Malware payload (Formbook)", "value": "ace93beab0a325291c9918a830bcb06bb60a014e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700489767, "uuid": "4074e538-9f6e-4bc4-a339-3ed5241d933e", "comment": "Malware payload (Formbook)", "value": "8a1a9551de3c78cec0c56dc3e974e09665622e2b1bcbf256b8d1e29c061735d666ae79d7d1a48aabe66d8c20da995d64", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700489767, "uuid": "d51b07d9-8074-4305-9375-bcc5abea992f", "value": "T139E423B6B44486F3CE9A21F2443679401B713D5A6C52DBFC0CB6728A07F67498722E7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700489767, "uuid": "d0f3cb9f-96a9-42fe-9927-1081a7e18c70", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700489767, "uuid": "4c0d5b4a-8264-4d3b-8dfc-73e545aa903a", "value": "12288:92361h61EWGDYvDHarJnCOrMPZCVnIItt3zJl8R5ot1BplECGvKVW9phs2:97Y7GkLHatnCZPZOn9ttfzaC1Qj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700489767, "uuid": "fce8930f-b0ad-401b-a79e-b4e837752238", "value": 665600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700489767, "uuid": "27208c14-097f-4985-ac9e-c8ad09395eed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700489767, "uuid": "c09cab4f-3f3c-46db-a92b-ca01edfae67e", "value": "009c487a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c95325d-873b-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700439898, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700439898, "uuid": "43327c3d-c962-4b69-86f8-4bf885145d90", "comment": "Malware payload", "value": "096f26cb0e4b9e7ade00425ee48dc20f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700439898, "uuid": "1dda5941-3646-4f1a-b00a-4ebaa3080b86", "comment": "Malware payload", "value": "b9385c055f82547a6b8b3ab94b1d019af745169cf47cf0e32f030365220f04f4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700439898, "uuid": "ae373a27-5b1a-4232-9b25-c53824b471ad", "comment": "Malware payload", "value": "6494f78b8b4120abbb419d4a08abc7c647b7e3b1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700439898, "uuid": "7c77f77c-e145-4f47-86d7-d5fb712ec954", "comment": "Malware payload", "value": "2716ce0ac9c2b72ade77d2376daa3a9c41de44a55d58ec5c2cd42e8949cc60d25aaf6e736ef7b0bf9339346bb39db6a6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700439898, "uuid": "a2368c19-bf2f-436a-b722-0464b12ce75c", "value": "T1D376331178E1A4B1E556C470C8806FB3E1EA7BD86B66C56317FEAA3C593D388C23193D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700439898, "uuid": "d8422809-35bc-476d-95d9-bea06a9a63d7", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700439898, "uuid": "c1c360d8-a4ff-489c-8ca2-e82ba50e7711", "value": "196608:91Ofsksv1meuNGEUXqfNDpjGzWXanV4D0HercSqNohZ:3Okks9+naqVdGA0Her1pZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700439898, "uuid": "c54f3a1c-1d7a-4a51-ad9c-2279e6a5ba79", "value": 7487191, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700439898, "uuid": "6239fa5b-079b-451f-8cee-61d0477520af", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700439898, "uuid": "f188efa9-47dc-4507-8e47-5fbe7e663432", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80df847d-87d3-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700505296, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700505296, "uuid": "2dc80bc4-918c-4716-abe9-8a5577b6e8d5", "comment": "Malware payload", "value": "0c7ab53caf16e730fdfbd12741e3b201", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700505296, "uuid": "ec8d25c7-086f-4f67-ac88-07e8e884b971", "comment": "Malware payload", "value": "b9f2bfc2bcf4ef29b0b1de88b2bc0cccb3f7997d3f651f3ea93bb6ea993822b4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700505296, "uuid": "ef6583ba-26ef-4b54-b101-317f730fe3ae", "comment": "Malware payload", "value": "ff54c1620292f1c1ce7bec6a34b735a8fa7633c0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700505296, "uuid": "f6979067-95c7-47a1-8861-34a923b5c5ec", "comment": "Malware payload", "value": "ea6ed8c672694208820ca5538034b3a3525cb5f119a7d75ff3efaf603521ad2bb5a6a998198df3c054c4ad809d3f12b6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700505296, "uuid": "a7e8639a-bd1b-483a-ab32-52fdf528b81a", "value": "T16F75BF37696D25AEC479807D6F7CFF088DDEEA739255F42B402258F8842B8965CC821F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700505296, "uuid": "b373730f-d15d-4fea-9db4-b22b703625fb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700505296, "uuid": "07a29f40-b2c9-483e-90d3-e57be9b453e5", "value": "24576:1rU/y3tQ9Pg0oPR01vmZ8sRrxrYtrqXD68P7d3BFMukWMG+gcXh6dvrBV1gerPxc:1rU/+iBgZRcvmag9rYJqXKTG+g+h6dvq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700505296, "uuid": "b1146db8-666a-4d16-b447-db7ac75fe0b7", "value": 1566720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700505296, "uuid": "43bd837b-87c6-4bcc-9b6b-60cc2baf4603", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700505296, "uuid": "c1764f18-077e-4272-92f3-a9697969f8dc", "value": "ff54c1620292f1c1ce7bec6a34b735a8fa7633c0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c6a15b1-8771-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700463144, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700463144, "uuid": "9066bc08-e6f9-47ce-8458-b4f24ef417c2", "comment": "Malware payload", "value": "65d23e91c488b44dc21abeafcc93bb3f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700463144, "uuid": "a95caa3d-b6df-4f98-bb03-4ad25c0350c0", "comment": "Malware payload", "value": "badb6d9b1cdae7d1fb8bb0cabc1111d89376296b99fd81c4413b1d9111010c85", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700463144, "uuid": "257c6a4a-ebb9-48f1-9ccc-006c3f5dc2b5", "comment": "Malware payload", "value": "b47ebfafe45cf6c91efe2e20835d409236aac9a4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700463144, "uuid": "6a52b5d5-9d44-4f3a-97bc-24275ae237aa", "comment": "Malware payload", "value": "04402902f1115d91dfa93b93477c4275e4e7e04da983d723780286c9a3114db57bea676aa6a6b2845c5c435bb10ac76e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700463144, "uuid": "1ebb1452-9fec-4be0-8333-ce5eb7e2ded0", "value": "T1A3A47CA235C975AFDC2F4674031FEAB62A795CE07382496E4F80360D5C36A4A40EDED7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700463144, "uuid": "1120ba4e-397e-4d07-9717-c7fea3fd9a3d", "value": "6e7f9a29f2c85394521a08b9f31f6275", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700463144, "uuid": "58f5ee0c-58cc-4c46-9d4a-69e03e91c630", "value": "6144:dT4DtDPZVheNA+ff0hOziZpnpLo9/0X5H4AiTtxYOwu79LrlynFY:dT0nhe2ek5qiEZxp90nFY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700463144, "uuid": "bdf6245d-d859-4b54-92bf-ed6909c220e5", "value": 456072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700463144, "uuid": "be0ba9d9-bfcb-4fb0-9b29-95c6ff70d57e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700463144, "uuid": "d8ee07cf-17d6-4a03-a05b-8805bc2365fe", "value": "Transferencia-30.000,00 EURpdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9272986-87a5-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700485714, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700485714, "uuid": "11eb2611-91f3-49c4-852b-431f09ced13d", "comment": "Malware payload", "value": "e3e12b8bc24de71859fa1b6d94a9af7a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700485714, "uuid": "131e965f-d4f2-40c7-b115-75ce3ee0eed7", "comment": "Malware payload", "value": "baecc220afc657acb2f09747419a54964b12b03c2c68f848cac60262ff7b44da", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700485714, "uuid": "ef6947e8-692b-4c57-9fab-225ca2cc08a9", "comment": "Malware payload", "value": "bb69829e2f2b9f9be39ae8edfafcdcec846d6598", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700485714, "uuid": "295fed3a-08c5-4605-9743-14d443475162", "comment": "Malware payload", "value": "5bc6822c8427477a3909bbb0418a21d7fe40f31120350575f9e8cf2738f7f138eb7ff29316e27f551536a7fc63b2f110", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700485714, "uuid": "4066511f-c496-4b1f-831c-b61ebf7809a6", "value": "T1EC85F1114B2F1E16FE656524F58F870077F95DD7A44DEAECACE280B8A1C4BD7CA842D0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700485714, "uuid": "9937c41c-e1ee-48b6-b2cb-cd4d4017fb7c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700485714, "uuid": "a263d34a-333e-4805-9321-71095e0625f1", "value": "24576:JzEZWa7NVEGjUW1K6qcjSavmntkgfYHp1n1w0OCU/EarRtElOuF9wu46h1eZlU43:FEkHWgcjSaOagfqPn1Ghs9w6h1wQxZM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700485714, "uuid": "1f18f79a-b838-4b12-8a61-8ab86967a930", "value": 1757584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700485714, "uuid": "d84c5873-aec2-42f6-808b-694aa43fec74", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700485714, "uuid": "9ababd3e-f1d5-4642-88a2-099e5e761cbf", "value": "271145211.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0706762c-87b0-11ee-8907-42010a9c0042", "comment": "Malware payload (CoinMiner)", "timestamp": 1700490059, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700490059, "uuid": "a83134a8-607c-434a-956c-53ae096e404b", "comment": "Malware payload (CoinMiner)", "value": "7c93c2206fd0de07383e0e1ea048f37a", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700490059, "uuid": "0a6c124a-f4e0-4119-9c87-ab59e0133d97", "comment": "Malware payload (CoinMiner)", "value": "bb34a64365015b36edbc8a0f3a5c7a3646c6d1b0330e5e47b4afcb340adf05d4", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700490059, "uuid": "293eac12-8bad-4354-8b33-c43157d94656", "comment": "Malware payload (CoinMiner)", "value": "235cf088388dca511944495eff7eceed0d12aa20", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700490059, "uuid": "0bfac486-0539-4ff9-9517-888dc1511340", "comment": "Malware payload (CoinMiner)", "value": "54cd598518c6a64f111f2ed0235f6a4439d6d9e2a8b51ed91cd0621f45eff96d6829d93a5432dc3c19983587c4cb890b", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700490059, "uuid": "d226ec23-e2cc-442a-a789-406dce988870", "value": "T13914CF22B6E1C073F26759344EB2C2615B27BC629B7195CF27883B6E4E216D2CA75307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700490059, "uuid": "eeb779d0-d9a6-4d8a-98b7-83420c1b84e1", "value": "b759efdfaa2b106a9868739336fc4103", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700490059, "uuid": "401a734a-9711-4fcf-9103-89cfc04380ce", "value": "3072:6Hd3HQ9ewY9mwOGgTOSp6nwSbpbAuYrvGhKs+lZ9WoXxp:a2ed9m/GNSpGwebAuYyh8Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700490059, "uuid": "cfd02d9d-010d-4aed-ade8-3ac2cac2b527", "value": 205824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700490059, "uuid": "e957fc12-2007-4cd5-9117-351590d61706", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700490059, "uuid": "47d49221-79c5-4c4f-81a6-5a47355f96aa", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e129b5c-87d4-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700505774, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700505774, "uuid": "89fbece6-044d-4236-9d47-85330ea4d5a0", "comment": "Malware payload", "value": "634b971feb600fe9357e26feb7ddabd4", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700505774, "uuid": "b35cd9e5-8ec9-4b36-b93d-d16c6f9e4e7f", "comment": "Malware payload", "value": "bb3d88de4f38e7e76c3b5a6345d7ee262af92bb467e088e1425a6dc06b86a1f0", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700505774, "uuid": "5521b428-2929-4fcb-aeed-4a245a462341", "comment": "Malware payload", "value": "0c9913031dac6ab3f6851615360b67aa7005ea11", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700505774, "uuid": "e0a2270e-a1db-473d-88b8-0db689cd8265", "comment": "Malware payload", "value": "c399d12110333edcab2b99b17aa352401bffb0ecdd47f31271047a70d215e96023ddb291549eb6e580af1ee9f0b9634d", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700505774, "uuid": "44d6c879-7168-419e-83fa-aa36c72af01b", "value": "T1FCA533B5CCA89359C6F935B7CB1244F82C81E41087FB7FD38E65DB34C6D64399A86822", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700505774, "uuid": "e650b1d5-335e-4249-bab5-1a3bffb7315f", "value": "49152:H/nEZHEf9LlCcY8YX8ZjiYgqTJP31LH3hJRu+4FO3OrG5ncyVKx:H8ZHQRnjiYgyP31LH3rRu+4FZr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700505774, "uuid": "5957ba4d-68fa-46e5-a9a1-95e232dd4e1d", "value": 2137653, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700505774, "uuid": "72654cfb-4da8-4d97-a482-c53152160a76", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700505774, "uuid": "3c26cf3b-ce96-4010-a462-f8981aa90665", "value": "gruppo.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28e651f5-87af-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700489687, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700489687, "uuid": "289022ba-0f61-402d-a63f-7d8697a4510b", "comment": "Malware payload", "value": "17bffcf4977b5e91a0efc2ba789d3d36", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700489687, "uuid": "7863162a-c4b0-4398-ba77-6a6c2b32f868", "comment": "Malware payload", "value": "bb4794860f17f652969abd41bb016a240b1ec4ee0c60fa4968f7759d2a35fce1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700489687, "uuid": "f347bee4-e85d-458e-8f4a-8f7e7094dd0d", "comment": "Malware payload", "value": "b3a68d52a449a5919cf5384387db872d1cee66d5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700489687, "uuid": "7e9dfa57-a12d-4705-adf9-f787f4a8163c", "comment": "Malware payload", "value": "ce0301c99ba5390e98e6e209ab45f109822ad5c739bb7907291a8f43742e9cf9379dbff7eb1b6479ce80fc037810b69f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700489687, "uuid": "4054ab3e-5b6b-4bc4-a58f-8ff77e79e37b", "value": "T1B745E150FE9DDF22E57257F655A260624BB1628E2221D5083DCE31E7C731F432A82F6B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700489687, "uuid": "76739523-b225-410a-93fd-7a31d0934b7c", "value": "6144:hDmad57XePl3DvJxWcvJJaSQlUIYkmhol6GSKpWfZiLcTHhs2R0nmw6iBY:hKVDW5Uhkh6Gsfmssis68Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700489687, "uuid": "787e2ff8-5337-434e-bf5c-b7bce676035a", "value": 1245184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700489687, "uuid": "3ce2bccd-21d6-4f16-8c53-ebcb7d76b2dc", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700489687, "uuid": "63aba738-1aa1-4858-862d-c1982cca387e", "value": "Invoice #80752.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4cb45e78-874b-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1700446797, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700446797, "uuid": "b54a842e-7e6c-47ad-8664-402f93126bcd", "comment": "Malware payload (AgentTesla)", "value": "580374153abe23627577f1ec72eee376", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700446797, "uuid": "18e77135-0bc9-413c-9985-256153af77ce", "comment": "Malware payload (AgentTesla)", "value": "bc1bfbbbff6ee2443b839aa6d4fcb32f4d0cfe9f395b534b4c46288c7a21aced", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700446797, "uuid": "3d12b808-a08c-44f4-8879-7c811a03d3cb", "comment": "Malware payload (AgentTesla)", "value": "5eed1381407b382bff3cafdd846574487f34c68d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700446797, "uuid": "f032ae44-ee82-42bc-b8dc-4baadfcd16b8", "comment": "Malware payload (AgentTesla)", "value": "2f299cc9cab838a88683d58205382b282a5711f05ad1d8f485622fc5f5759a1884abf353fbbb02f0d6e8be4bd8211ed5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700446797, "uuid": "59a62063-dfcc-435d-9489-a159f60b56f8", "value": "T133E423B43BC003BFC6D25DF22866B15E13F7BA9A9C73D54A6C8170DA4DE2F4A15014AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700446797, "uuid": "3191e15e-862a-4057-9185-531015719500", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700446797, "uuid": "f8d2efbc-a474-43fd-9fd9-c01d2252af27", "value": "12288:8h361h61EWG+kacN/e2wlR2nX9KoAtPCGDLbkHLKxn6VlapogCgyUVR6Ww9I61:8cY7GTK2nXUvtPNLIM6VlXgCLmYWwD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700446797, "uuid": "57209f88-da34-4b9d-b53d-6152912a1435", "value": 668160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700446797, "uuid": "598b8981-8b77-4460-9c05-7a59bb7240a1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700446797, "uuid": "79022f89-919c-4019-8916-c7c0695563e5", "value": "SecuriteInfo.com.Win32.PWSX-gen.3683.17636", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ce850b2-8772-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1700463494, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700463494, "uuid": "e92cec7b-2d0a-4211-a91d-40bcc1ca6450", "comment": "Malware payload (AgentTesla)", "value": "fc88d3da0f84dc02777529f7faa811b9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700463494, "uuid": "1c33fee1-3098-4ad6-8fd5-34bf3b2affc3", "comment": "Malware payload (AgentTesla)", "value": "bc28e3e93f930d14d3405067cae6a5960a6bc4f7c8cc58dd3204f6e2634c1f8a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700463494, "uuid": "d6c6497f-bb65-49cf-8cc0-2abe819591c2", "comment": "Malware payload (AgentTesla)", "value": "8bbef3010f6b83cbdae8f82d1823692f0b7649df", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700463494, "uuid": "5e20c796-26e4-4234-8286-0a8a6cbd16a9", "comment": "Malware payload (AgentTesla)", "value": "8658c974b1f2bd239eabb91d82ada6af880c609e9c740c50d87f6e2d978ad434f48dee7b90ca1f492465547ce5c44958", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700463494, "uuid": "89c95411-5909-4094-99bd-065e03896b6c", "value": "T194F4053D1B9E0667FCB9D6A7EFD0812BF461AAE3F2099D24D4D703555302A42B0D827E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700463494, "uuid": "7b72ddb8-68ed-4e8e-8ada-e1b563867e31", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700463494, "uuid": "27f88a1e-1014-488f-b52e-c7986ec34ca1", "value": "12288:TBa/mFiTEJ0+0OR8FCko3o/WX3VOiaaRW//hucE+lih6dTE8RSASswdxmJfIC9ot:yeXRRUUqK8RSA4dxmqd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700463494, "uuid": "e4dfb73e-16ac-4b47-9bcb-fb6f1dc18f49", "value": 777216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700463494, "uuid": "e5f8074d-7be4-4f24-811e-0f3310364b81", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700463494, "uuid": "bba4fb27-b132-4395-9b2c-badb53c2385f", "value": "Payment Advice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77939ed6-8760-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1700455888, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700455888, "uuid": "83436304-87ff-4d1c-b298-f729a8066634", "comment": "Malware payload (Mirai)", "value": "39eab1d9f34e73fc4b956107c2e728e7", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700455888, "uuid": "828d7515-2568-469d-a46b-cd87242e87a0", "comment": "Malware payload (Mirai)", "value": "bdda794679928bce5a1dc1f9b57bafc43efcb5304b735ea2c8fe9b787ed5befd", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700455888, "uuid": "7211f448-607f-49d3-82f4-5688d9c9972b", "comment": "Malware payload (Mirai)", "value": "4ad45b2b0227e489ee7bff29620e5cd17a694682", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700455888, "uuid": "64ea6a85-1851-412d-8762-fa154ea72b28", "comment": "Malware payload (Mirai)", "value": "ae98d2e6b3371de513dc36dc11c3349662c4c0893e6f204d37e08a0b78bc66a1c68ad8c819e003b20d6fbf196e7bb5d4", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700455888, "uuid": "2a94bed5-96b0-43e8-b8ac-8907fe0e84be", "value": "T1BDC30945FC415B13C6C212B7FB5E428D3B2A17A8D3EE72039D216F61378B95B0E36A42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700455888, "uuid": "ca663b99-3e23-4387-9481-b66c45e97e4a", "value": "3072:Yr9Ogxqij71wdk4H0qCROPB+l46S64Ybb:Yr9607q+4H/CROPBMSzY3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700455888, "uuid": "947e8acc-9e4e-4330-8f4c-76f5bd39e114", "value": 129792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700455888, "uuid": "be55e0b6-9016-4304-a14d-666369d83106", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700455888, "uuid": "41809122-9c01-4ed1-8892-31d8c0398420", "value": "top1hbt.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b91e48d4-8766-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1700458575, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700458575, "uuid": "dd8d7855-1529-4c51-a340-ba9e945fba0d", "comment": "Malware payload (Mirai)", "value": "efbcd3e23f244af7db264e8181b9da9b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700458575, "uuid": "0dce023a-d151-4e0d-81c6-c563600986a5", "comment": "Malware payload (Mirai)", "value": "bf8243aa64fb9804cb403ea5eef6e9b7293d9b58f2bcb68b803b4969a63c6452", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700458575, "uuid": "942b807a-e328-42bf-b2a2-e48fe8c57744", "comment": "Malware payload (Mirai)", "value": "236638090eb6c77eb804a9f13dac71c88dccf825", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700458575, "uuid": "078ce5cd-8cba-40bf-a769-d10707c7093c", "comment": "Malware payload (Mirai)", "value": "7a78ccd4c354e1906a34b9384abfa4438c5933f506c1db52f42214ee5fe23f7832d2d8d575a33ab66109446e14776378", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700458575, "uuid": "fc3e8942-756d-4bea-9e54-62c5e8ad5a97", "value": "T125D32A06B30C0A47D2632EF43A3F67D093EF9AC121E4F640356FAA899172E365585EDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700458575, "uuid": "0913a3da-9a23-48ea-a10b-96a77957b347", "value": "1536:a0nwyqWv6n/qZIRgSH98z+xpnvTnNoIRF9Ugg97PMXgvAtId0DD2h/qvI8kpd/zY:GWv6/gy8z+x57ndngpPMVtUpdbyX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700458575, "uuid": "bea51bde-12cb-49b5-988b-63ca1ac6cd91", "value": 132344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700458575, "uuid": "00d273de-f1a2-413d-9934-6e0c5e0176c4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700458575, "uuid": "18c25f8a-30c5-4ba3-82ff-8cd932be2d94", "value": "efbcd3e23f244af7db264e8181b9da9b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d043ab64-87e9-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700514878, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700514878, "uuid": "7cfd597b-88f1-4f38-ae38-829f998156ba", "comment": "Malware payload", "value": "73af2b313925da0e49f1c99e1b51ec4b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700514878, "uuid": "9bbc964c-5c0f-4ddf-b4e9-b01d2574334a", "comment": "Malware payload", "value": "bf91852588010cca4ca8aa2f419531df69a6e5454f471ebb2e862c17b99e5724", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700514878, "uuid": "5ce12a37-c8a9-434b-8f20-92a2779c1e67", "comment": "Malware payload", "value": "4f4bd4f230b2d2bc6f140d38f8c301a3264747a0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700514878, "uuid": "1989ba69-719d-479b-88d6-ec736c8af0e2", "comment": "Malware payload", "value": "c6bb72a5ac81db5e600b42a5890f6197e04278773d7a3bb5f59a93bc067fc671edebc4ecbc8d027b6f86c5cb24f837a6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700514878, "uuid": "6c106f86-781d-43da-8cd6-86cdaf9a4f53", "value": "T1FD15CFC4E54416A0DD6DA771AA36CE3106237DBDA838D52CACDE7D2B3BBB7835011923", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700514878, "uuid": "26e36440-5955-49a5-afc5-0421aeace0b6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700514878, "uuid": "c4d024d0-e35c-40ac-a8e9-168fc24ce7ba", "value": "24576:ve4ucqeAete6Fnj5k359f5fHi/dkGxris1q:3ucN3Fnjw53exel", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700514878, "uuid": "a917ac2d-d565-4ca0-a132-a87d383bbc11", "value": 911872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700514878, "uuid": "8d04e58a-f7ef-454f-9cc5-28acab795aba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700514878, "uuid": "ab63b3ca-fe11-45c0-9d2b-06227594e709", "value": "Payment Status.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f428e9f-876d-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1700461538, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700461538, "uuid": "e17ad135-49c0-471c-b2ee-ecb850b1f5c1", "comment": "Malware payload (Mirai)", "value": "c9d506c1c8a8b2f52d9d6580a58365d5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700461538, "uuid": "79f9250e-43b8-413d-9dac-faae6e05c022", "comment": "Malware payload (Mirai)", "value": "c0145017aacf28901928f5f32ba74944975941b4487b7eee227274ebb856419e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700461538, "uuid": "740d9d14-bc26-422b-b07c-482d06443ca4", "comment": "Malware payload (Mirai)", "value": "c25040be41107ddb200f4ced4f5d1377b349c0cf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700461538, "uuid": "79a06163-2faa-49c5-a3a1-169bcc68318a", "comment": "Malware payload (Mirai)", "value": "30b736dd4284ea5f881d6419105bdb07d33cf2afde2f541cc3591886a47f867fd3096f061262f21fbe0636e9838763f9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700461538, "uuid": "10a5089a-ec18-4cde-b5be-57c5d989bb9a", "value": "T12D130142D1C231F38AB52F759B36855B73AC53E882F0B922C006564B1DDBB09EBED813", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700461538, "uuid": "39363531-c038-4db2-80b9-42cc717c82a2", "value": "768:tvNJNSqVRZClf/o5vY+fAs/rXRRq3UI3TPgb87wyVFcnJ1D8:tXNSQRZCJ/iw+IMXR+rgb6Fd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700461538, "uuid": "60528f9f-e0a4-40ad-b1ac-cbcf34bc90b9", "value": 44636, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700461538, "uuid": "5b523aec-231d-4a57-bcf0-d3d19c8bb8a4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700461538, "uuid": "343c4e68-bd10-48a4-b8d6-61a6f34b7558", "value": "SecuriteInfo.com.Linux.Siggen.9999.20159.633", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2278d3d8-8771-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700463047, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700463047, "uuid": "8ad8dd7e-6a7f-481e-9bbf-19a5bbb5ea39", "comment": "Malware payload", "value": "fbc97ba1b91352c8ed3b82a262878ad8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700463047, "uuid": "3ed54c35-db6e-4715-95bf-6b621bcac83a", "comment": "Malware payload", "value": "c1da889268db3a1dd91eda6f8696a9f9f6750012cf40f14fc3b38fc0d831610d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700463047, "uuid": "65de7e7a-59d0-459e-8d6e-6b0abca331e8", "comment": "Malware payload", "value": "77d8935d4a23d8e3fd9d34786186fb18d99ca826", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700463047, "uuid": "09f5efe7-8f3e-424c-87a1-5c4580d882da", "comment": "Malware payload", "value": "e200ba0a01afeeb1e4d1e41fc4725414a9899356ddc15c1b2d946e2407aa0ae855d59b1d623d4475d44bc1194df62c41", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700463047, "uuid": "376b3797-78e4-4a79-87c1-4e93ce4c7df3", "value": "T19445D081628D9C8EE1476FF60A5E943011657CBE4511E60D2E83EB3BE0E631261BBF5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700463047, "uuid": "2b46b6c9-953e-4420-ae8f-3b8a2d5ca9d1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700463047, "uuid": "8c666703-a8c1-4afc-bc61-d73fb009b60e", "value": "24576:BitnNoR0E//vld9g2ZAzML5sCH+5kvuZTZtbMPvNd8:BiBEb9XZmMLujZAXNK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700463047, "uuid": "807be979-8cbd-428b-8a15-a272bf9d8989", "value": 1188864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700463047, "uuid": "9eab3142-f65e-4eef-a10e-af74c921507e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700463047, "uuid": "a983497f-b860-44ae-a4e8-a2435939e467", "value": "CHIMICAL LIST#00687.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7253444d-87c6-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700499688, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700499688, "uuid": "15967438-4b1a-4544-b8f9-e412c9134012", "comment": "Malware payload", "value": "ef8e8428ede542ee18f948aa9e28c755", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700499688, "uuid": "5041eef0-256b-4ac0-9c5a-d3bb5af80387", "comment": "Malware payload", "value": "c239cd8875dda19ab50c6cfa9a4115bb9dad142009da3a2fb4291fa42e0a1493", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700499688, "uuid": "5cacc418-485d-4440-a5e4-f8c157af291a", "comment": "Malware payload", "value": "a1798f5727e126a68ebc9461ffdb427e6c7bf412", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700499688, "uuid": "80b7534d-1413-4957-9b60-6ae5d9c0c24f", "comment": "Malware payload", "value": "12ab834d143a4f94f2930a737aeeaf20b6701dc99c1bc38abc7c84d6415d29c4a545badbfe84291d267cefccfb6dffda", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700499688, "uuid": "cddfa93e-df35-4a33-96da-e3fb4fdb99ac", "value": "T153F63356E2D85AD4C977853ACFA0002AE937E8311B34CBDBC7B590922E7B2C15D7B724", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700499688, "uuid": "da9065be-1b92-4145-8c2a-621139f5e8cb", "value": "bae3d3e8262d7ce7e9ee69cc1b630d3a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700499688, "uuid": "b1f5c3e2-d2f8-4f45-82c2-755022227e5a", "value": "393216:i+xg7BcDNARdOo60Kw6HW+eGQR29jokUy5IaJWyt/WoHXQP:i+uyDa8VHNHW+e5R29MHgpHgP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700499688, "uuid": "11a40677-6af3-49ba-85b1-d23577631d81", "value": 15328736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700499688, "uuid": "89b49835-3662-4d38-9b08-af4221f876f4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700499688, "uuid": "48d2dd65-0eec-4cae-8b0d-b3a98a676f51", "value": "hgfdhbgd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "badc5069-874c-11ee-8907-42010a9c0042", "comment": "Malware payload (IRATA)", "timestamp": 1700447411, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700447411, "uuid": "817764dd-56e5-4b78-a755-6546f10dab10", "comment": "Malware payload (IRATA)", "value": "e8d1dba8557e9cc05e776c98cb1d4487", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700447411, "uuid": "52f253c9-c61f-455d-8088-02c263e54a2d", "comment": "Malware payload (IRATA)", "value": "c3a9e6a732a84fe4b81b1baeae069ec493e06318fcd5e64292f1ff6cb1f1caa9", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700447411, "uuid": "fa439401-9cc3-4db4-bd8f-8c38930ec8a8", "comment": "Malware payload (IRATA)", "value": "fd1d075c7096998cc8992d18f4f9df0c853130e2", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700447411, "uuid": "358ad877-e540-4b26-9fdf-cada16caa575", "comment": "Malware payload (IRATA)", "value": "963a6f185e2f97570c08f530f24a0d4f71eff87735463f5d32ce715f598a470c87c332d9ae05e2da15a19c7ed00a57cb", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700447411, "uuid": "3612c14e-d1f6-4e91-9871-a5c38643cadb", "value": "T1F3D52393F326A42BCCF6C37222B5163651778D248B47A789291877B938BBCDC4B853D1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700447411, "uuid": "34733a0c-f256-4a1a-89a5-6aee349b1b23", "value": "49152:AELNiEtX4NYWzTPueV9/o514d117ennUl1GlM5rlnUj2dbWP2wnVjHM/81:AQLtX4NYiT2+9e1k1xenUl1GazxWP2Uf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700447411, "uuid": "08eb561f-d5cf-432e-8554-5b1a33f481c4", "value": 2760834, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700447411, "uuid": "18b61d46-0955-450b-9392-1315d1e2103d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700447411, "uuid": "e29b44c4-a473-45bc-abed-b012cf7f9667", "value": "saham.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "354bc420-8794-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700478111, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700478111, "uuid": "cf1cbb89-f0e3-4c78-ab98-46be721c3651", "comment": "Malware payload", "value": "f1f3345b34c2429b71f31cf6fcb0573b", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false }, { "name": "zip2", "colour": "#64FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700478111, "uuid": "c6a34ad4-1256-4782-8812-8019072f6eff", "comment": "Malware payload", "value": "c535c42a48ea714542a7fc03b79635dbca86095f653ae05c021f9ed76c580be3", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false }, { "name": "zip2", "colour": "#64FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700478111, "uuid": "00a89e97-b99c-4b35-81fe-b9acde825d2c", "comment": "Malware payload", "value": "973a812bc5f04444d7ae71d927d4cd583315584b", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false }, { "name": "zip2", "colour": "#64FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700478111, "uuid": "94e89153-c501-4a7f-a9cd-76f1fd3ae386", "comment": "Malware payload", "value": "05c2c4b8175c0deb2cff8fb7ad4ef61292200328957b97730ab07d249579ab8d6cba3c10fa3923593ffd9a2a8ce5bf85", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "SMB", "colour": "#24B501", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false }, { "name": "zip2", "colour": "#64FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700478111, "uuid": "f01c46a5-7f0b-40d1-8be2-5d405930cf3f", "value": "T15955334F53A0A599B21167F363B0C326EEF8685DFCA62480EC4964C07E737590F6BA35", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700478111, "uuid": "c8fb54b7-f5a1-4c94-8311-3a99c99ff8c5", "value": "24576:QP0WJfinl/tvz9BmyVvK53XRoPMYgfG7WjGkkYYW/Pn8Mf0XwgEvD05GN:o0WJfin7v5Bne3hEBg1GpYN/Pn8e0gJZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700478111, "uuid": "5cc1c87a-c027-4968-9e71-df9f784a5aca", "value": 1318979, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700478111, "uuid": "9d58e1f0-114f-4775-a3e1-ffafa38f7f59", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700478111, "uuid": "ef32f6a9-fec2-4168-99f9-d8750d5bfb2a", "value": "gruppo.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ea82de4-8773-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1700463953, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700463953, "uuid": "390b9951-9f0e-4761-888b-69584e56e160", "comment": "Malware payload (AgentTesla)", "value": "0267472915c63ea5dbfa33fd3c16716c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700463953, "uuid": "89cc6a68-0a33-4cd8-8119-9233544f55da", "comment": "Malware payload (AgentTesla)", "value": "c55f49ccf18c2ddf0771fa99d174d5fc6460e24c67bc23505931bf0e7127ec59", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700463953, "uuid": "4650b3d2-1eb8-4ebf-9810-eb7c2cc38d35", "comment": "Malware payload (AgentTesla)", "value": "d21561b439a6cfe324b3efdba694d7e033c9a0a7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700463953, "uuid": "3a45d040-10c0-4161-9c21-f9d0c63c7254", "comment": "Malware payload (AgentTesla)", "value": "51b47efd6b87e81c4b6f8192c5f40403ba817bcc29aace219b50923314a62149182c777ee441fbd36372de34314bb4cf", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700463953, "uuid": "196ad149-76b1-4269-8ca4-faec1b05d28e", "value": "T1C7B49D9C3650B2EFC86BC87289A82CA4E66174BB471BD617901316ADDE0DAD7CF141F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700463953, "uuid": "b2a4aa6c-da22-470d-ba7d-9f00ef4bd7bd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700463953, "uuid": "2922bedf-d593-43f2-8da3-f40c1945dca2", "value": "12288:a8c61h61EWGmBvUkW3G+RzTA8Ks31ytZVcDkv4xk0U+1rNHSY61:aGY7GqvIpCss", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700463953, "uuid": "b7202123-d35f-45df-9f09-b7a4777b0684", "value": 496128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700463953, "uuid": "67bd1741-cafd-4c2d-abe1-094846a14b1d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700463953, "uuid": "ee4e38c6-f4f5-42ff-990f-6b7a831894c1", "value": "poc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a142901a-877f-11ee-8907-42010a9c0042", "comment": "Malware payload (RemcosRAT)", "timestamp": 1700469273, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700469273, "uuid": "8e0004d7-da3b-46ab-b3da-f1d190052668", "comment": "Malware payload (RemcosRAT)", "value": "b58dfb8d67643154b19a01a2d2dcb164", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700469273, "uuid": "821a738b-70ca-4f0e-ba5c-180cdc77445f", "comment": "Malware payload (RemcosRAT)", "value": "c5dbfc964af7d4ee10be38a9412679bc1bcbf2b491fc68b7ecd15aef14febae1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700469273, "uuid": "adf87bb6-70ab-439e-9a94-b5f12e03b16d", "comment": "Malware payload (RemcosRAT)", "value": "9d59b2f3f00c9414232a48003851fb32b839a426", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700469273, "uuid": "16548ab9-bd21-41ca-98c7-a4b53ba47304", "comment": "Malware payload (RemcosRAT)", "value": "15533cee49ce0d817ecd14291d29c805a988ee74dd6a19da14378dc077608d75f3014262c92b68dc7b954f85d89a4607", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700469273, "uuid": "f8f47099-e317-446d-ae58-8618b0820ca7", "value": "T1BD350152F6904556ED2D0BB564334C740B737E3AF9B0E38D1D9B72B82BB3782412269B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700469273, "uuid": "0b8b0daa-6415-4989-908e-cfb821c40c3a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700469273, "uuid": "6a9d846a-6445-45ae-af43-26196a8f5513", "value": "24576:j3cVm0BTOgvTqDul6mRq5uAoAhDIBtqtyMSM4nfCeCCnycFix:j3cA0B3GSzRm7RntyMSvnKWycFi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700469273, "uuid": "c1c3ccb0-ef21-46d2-b01b-ccbe443e359a", "value": 1084416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700469273, "uuid": "d79fb964-23f6-432f-a4da-83b3fecdd53e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700469273, "uuid": "2eaf9b25-a8f6-4c5d-8bab-77519625a809", "value": "Swift Copy MT103_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79ff8b67-8760-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1700455892, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700455892, "uuid": "6abf0fa9-161f-482e-b43e-bc8bd9e61ca1", "comment": "Malware payload (Mirai)", "value": "ac7dc6020dc85bee471a14ea0bb773b7", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700455892, "uuid": "6a706bbe-bffb-4375-8fa3-b6b245b26a70", "comment": "Malware payload (Mirai)", "value": "c60cc800b4fcb61935595825151e654d1edd1a8478bd54206d22e26647d1cebf", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700455892, "uuid": "d347a3c3-b8c9-4668-a681-33ae1c6d3034", "comment": "Malware payload (Mirai)", "value": "f6f8718bd6bd6c805d322b41af3ca366ab7de218", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700455892, "uuid": "e76d1479-fd76-484a-a272-77ff5625652a", "comment": "Malware payload (Mirai)", "value": "6a9f6623a8b1e5c20512f5d5391a87ea49ca8a518660ec06c01873ae32e5588fc0657b974d8bd77b15bf58c7821e93c6", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700455892, "uuid": "8193fe64-dbd4-42aa-b2be-e0113f67229d", "value": "T108E31B46F9819B12D5C111BAFE1D124E37231B78E2DE7302AD246F747B8A97B0E3B905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700455892, "uuid": "66159b4c-2cee-4980-a312-48b796d9bb79", "value": "3072:lQxnUv8drbAXcoafwJauX5yjwzCO3GpRp8o:lQJ0OAXFafwaO3H3GpRuo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700455892, "uuid": "6a5963c0-d1a8-4618-b6e9-20c55004d335", "value": 143292, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700455892, "uuid": "67b4bd3e-7a4c-41b7-a88d-235e9df3fd90", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700455892, "uuid": "a1880dd3-874f-4f97-9a85-91a0c16986ae", "value": "top1hbt.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01f2c090-8775-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700464710, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700464710, "uuid": "8a187b27-7feb-4343-9460-c1ee6cb957df", "comment": "Malware payload", "value": "18ebab354f5e00a6db82541c3076bc54", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700464710, "uuid": "f235dc8f-6540-4f00-a790-1625be332dc5", "comment": "Malware payload", "value": "c70080a16f834ce9c1fb6fdf0e98bd76a2b230dbbf8529c9bdbc27531042c9ca", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700464710, "uuid": "b0bccbac-cfdf-4d97-a7ad-65eea6a42030", "comment": "Malware payload", "value": "37ec8eacb19ace469d12c0d2717b30adbf61e144", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700464710, "uuid": "cbf548ae-2145-4f03-8463-f16de8adb46b", "comment": "Malware payload", "value": "b04c28215641c87def8daf62ddcd509c20583466f215406e6f39f95ea9db379774bf20273b8f0086f3391d31a2002058", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700464710, "uuid": "706a9c02-06f2-4c79-9b88-c0ba8931cdb1", "value": "T16AE47303BA978DB5D39B2736C5BF04042B7CE8816213DF9F798AA3592843777AE40617", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700464710, "uuid": "5e1a8da6-37b0-4fb2-a8de-38eace2c9c26", "value": "12288:HRs5f1S1RJ8oy7PTjVcAAaPpaOYN7zsl2RdWN/8ypu8KN541rVIxxJom:OoUPTjVBAaRaf9CqdWN/8ah850rWx/7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700464710, "uuid": "df482a9e-bffb-4cb4-9703-2107f7764ca2", "value": 710128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700464710, "uuid": "def628fe-342b-4172-89a0-6865972ae371", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700464710, "uuid": "2fc1685e-ddbb-4076-b1f0-43df7a996eb9", "value": "SecuriteInfo.com.Win64.CrypterX-gen.4118.23067", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ede302c-87d1-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700504273, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700504273, "uuid": "963dc358-fb85-4243-8e2d-13a6eb673a41", "comment": "Malware payload", "value": "4f916a3a68617d5f8d3a36855467f058", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700504273, "uuid": "7c40a39f-564e-439e-b7d7-62448eb6b8d0", "comment": "Malware payload", "value": "c72275196919f799f14c58c35c70bf775f32eb85028c77791b1138c8e081e692", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700504273, "uuid": "1f1288d1-a7d5-41a5-80fe-a1c28f2ea5b4", "comment": "Malware payload", "value": "f99f90b37cb1180e3b4e5564139bfc5e57b10d66", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700504273, "uuid": "4dc3da29-0210-43e0-ae81-df0f992fc33e", "comment": "Malware payload", "value": "7726f70887b308b004d4033c61bf3d5c7310f92132e56a3d0be8de9d78e0aae628f2aae1ef51297b7b77eb06ff0f6661", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700504273, "uuid": "10af8bf3-645a-4d54-abd6-b53b5ea61e5a", "value": "T1B3D4220663ED5BF1D438CBF524BA128443B1E9967866E66CDED210EF00A2B024FD5F97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700504273, "uuid": "1a739798-4129-4801-9d05-0e85236ba897", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700504273, "uuid": "1bc2719a-28d1-45a7-80d2-f730c3ed103b", "value": "12288:uEX0COs1XivCewN2N5X3/ZbBw1EM8U7CZAftmZwfYHhd6RkzVOa:p1XiqewN2r/Z10bfIL2RW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700504273, "uuid": "1ea3f52a-7774-43cd-ba90-e2d2828e67e4", "value": 614912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700504273, "uuid": "988e24df-fc6b-4d24-9402-c95b8ba2bc51", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700504273, "uuid": "603f0ee8-e3c5-4f69-9f9d-bd27e0d09017", "value": "SecuriteInfo.com.Win32.PWSX-gen.31602.433", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3a2a4d0-87bd-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700496013, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700496013, "uuid": "f50eb101-71e9-4c64-943b-7e1bbd2f697e", "comment": "Malware payload", "value": "fdeccb927db95a038e0934564282044d", "object_relation": "md5", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "BianLian", "colour": "#F4DD08", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700496013, "uuid": "dd07c797-c2b0-4d97-ad0c-144066918776", "comment": "Malware payload", "value": "c775e6d87a3bcc5e94cd055fee859bdb6350af033114fe8588d2d4d4f6d2a3ae", "object_relation": "sha256", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "BianLian", "colour": "#F4DD08", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700496013, "uuid": "9b2f783b-fdd5-4b31-aa30-e4b7e6c2932e", "comment": "Malware payload", "value": "d019e36d39b13e8d447c20a04899ef8eddd93e1e", "object_relation": "sha1", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "BianLian", "colour": "#F4DD08", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700496013, "uuid": "d8f29257-3b6f-4305-aab9-cbbfa77cc894", "comment": "Malware payload", "value": "caf48c0da0f9635da2f26cf950155961f78209c786bc9d43c87c6e245506e47c5f45df039638e4f68ef33218efcf0698", "object_relation": "sha3-384", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "BianLian", "colour": "#F4DD08", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700496013, "uuid": "650ab538-756a-4d94-97ec-c67cd0d0155c", "value": "T164163907FCA545A9C0AAE23489769253BA717C881B3127D32F90F7782F77BD06A79740", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700496013, "uuid": "601da752-e912-422d-8616-18c9f9769e69", "value": "4f2f006e2ecf7172ad368f8289dc96c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700496013, "uuid": "e2a802d2-294c-466e-a0bf-040cb5d2e6a2", "value": "49152:3yZkyYno6khIeKLLa1AQLW+KrIMsWNQ34jb5EyNumUCvh4/qb:yqohh6LMpWVu3+E8vQq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700496013, "uuid": "bf311763-0263-476f-94df-0d92fa3ac816", "value": 4038656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700496013, "uuid": "54f62fc6-2719-4adf-bd63-ca715312f965", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700496013, "uuid": "9f963e08-890a-43da-a26a-9d09bd983e7c", "value": "bb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6db9e58e-8798-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700479924, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700479924, "uuid": "f051850f-9993-41c3-a6f5-0b2edd493e6a", "comment": "Malware payload", "value": "e4a08eac1cd28d230cfd64fbd77d7aa5", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IDAT loader", "colour": "#23D030", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700479924, "uuid": "faae1e10-0250-473f-8547-6c92f8af00b7", "comment": "Malware payload", "value": "c778e1287b2203d99cf0e7b99bc1d28383f22b398106ea41a0f6acd1c54d08c8", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IDAT loader", "colour": "#23D030", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700479924, "uuid": "34058007-6c51-45a1-828c-ecc472db2c59", "comment": "Malware payload", "value": "bc614be2f962f6193d03ffcb146b8c41ff9ebeea", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IDAT loader", "colour": "#23D030", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700479924, "uuid": "a83a1961-e448-4864-9aaf-04fdce05476f", "comment": "Malware payload", "value": "cb4d28be1e4b4f5b2cfe9e040413e22aa679cfb8c43545b34aa220d1365b917fd4ebe5dd6c0dd4f0ce99e2027041953c", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IDAT loader", "colour": "#23D030", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700479924, "uuid": "c59ca558-5209-420b-9af0-0f4ed2f5f647", "value": "T1D675E9E1E54974D4F2D71077858CF36B9AFDFA753BA928D9B042058D6AB03C2E811F82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700479924, "uuid": "6cb77d04-532b-434a-93a5-f15b618117b2", "value": "12288:m7KjxPmwYBtq34vkGHO52p8eo3G/PuYx+GWVc1ALJxGpyQ9HZSV8V+BPg6D83WG:FXFG/A3NGElIIV8V+YiwW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700479924, "uuid": "192cb5d2-ed77-4d80-913e-f1dbd1e50b3c", "value": 1552384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700479924, "uuid": "44d15658-704d-489e-a6fd-421af4b42c1d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700479924, "uuid": "13dd12cf-16e2-4bc9-ab9a-f05ad6a9eb24", "value": "c778e1287b2203d99cf0e7b99bc1d28383f22b398106ea41a0f6acd1c54d08c8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8087aa64-8773-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1700464064, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700464064, "uuid": "7b06998b-a9ed-40fd-ac56-07074f2dad27", "comment": "Malware payload (AgentTesla)", "value": "447f06dffa3fc69fd315021943c69a7b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700464064, "uuid": "a2f273f6-8920-4ade-8259-190c5b59ad23", "comment": "Malware payload (AgentTesla)", "value": "c7d021d6b55cb16c7a1b5804ff7b6748b3a90e642c3c09871cead249582a65da", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700464064, "uuid": "60774f1a-d19a-4745-a06b-624c9a45d6a9", "comment": "Malware payload (AgentTesla)", "value": "45d360d435fed6006cd706b6132efc631db49385", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700464064, "uuid": "e00b02d0-e345-44a5-8100-ceaba990cb5f", "comment": "Malware payload (AgentTesla)", "value": "2a0a81e9831c125d277b5a8ede0266da38b2426e6fceb7afd1a2eb7cbccd49b6890c37aaf3d72737b7e6e5b15315f75d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700464064, "uuid": "0142ff11-9637-42ef-90eb-7700a72d659b", "value": "T17D45190BB6868CA5D3872F77C5AB44101B7EF9C562A3C72F394A231928C376F6861717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700464064, "uuid": "a350aae5-4bc1-49e7-b529-537870a63028", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700464064, "uuid": "e8f7c576-0a32-4063-a6dc-cfcd0d26ca12", "value": "24576:0HEQkVcqU0kKEtE1t2vFGcSrNWHVaQweLMkHXQw5HT2Q3dH:Jqu1Ev2WHVadeIkHtHTnt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700464064, "uuid": "73906c94-94d6-4997-8cf5-a6b5d702efca", "value": 1239600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700464064, "uuid": "937eaf66-3339-458d-b50c-3af769a36f9b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700464064, "uuid": "cc079f64-648e-455f-82fe-cdc45068a382", "value": "Invoice Ningbo & Delivery Note Ningbo.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90b14fa5-8762-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700456789, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700456789, "uuid": "7c2b5036-4e75-40b3-ac78-a9d3f9b6a854", "comment": "Malware payload", "value": "d705dbd9df6cc99d7e50ff8545a074b3", "object_relation": "md5", "Tag": [ { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "lua", "colour": "#685EA2", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "Tasker", "colour": "#BB9C71", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700456789, "uuid": "b0070c08-7a18-4339-b4a5-79b912712152", "comment": "Malware payload", "value": "c8cf911730a7703a76266238c4d9199e457280aa30aa92ab5f5584d88abe6b04", "object_relation": "sha256", "Tag": [ { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "lua", "colour": "#685EA2", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "Tasker", "colour": "#BB9C71", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700456789, "uuid": "0dbac28c-cf30-4550-959e-fe28b22b00a9", "comment": "Malware payload", "value": "a3626e54e15f2c190a2c7cac01714472e6767323", "object_relation": "sha1", "Tag": [ { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "lua", "colour": "#685EA2", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "Tasker", "colour": "#BB9C71", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700456789, "uuid": "0e394b22-05cf-4bbe-aef9-ca728c685d87", "comment": "Malware payload", "value": "35687634eea4310af110e1a0a71f95eb52a37c83e299bad93d267a2b5ea5fd67fa5e061f133308f3b6d9d2c3d058fd2e", "object_relation": "sha3-384", "Tag": [ { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "lua", "colour": "#685EA2", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "Tasker", "colour": "#BB9C71", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700456789, "uuid": "4a92e32d-be59-4c7d-9051-7668d2f0bbfc", "value": "T1E9D5BE2A35CAC637EB7E82316669D77A61BE7EE00BB100DB63D42A1E1E305C14275F17", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700456789, "uuid": "b5622b27-89af-4df2-856c-af69c34d7ec3", "value": "49152:0lDUdqW8zBQSc0ZnSKQZKumZrzq4Fb6HXr1iWnYs4ntHurpllQ6akuxtZ3bv:H30ZnqKzFnWntux/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700456789, "uuid": "c4281da7-ea8c-480e-8b6f-1aed0517b1c0", "value": 2949120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700456789, "uuid": "7ef569da-5f09-49cb-8cac-5812cad6bacc", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700456789, "uuid": "b8582b55-1c6b-4f44-800d-427789217ceb", "value": "Cheat Lab 2.7.2.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d527fe48-87b4-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700492123, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700492123, "uuid": "43dcccc7-1b8e-427f-b7a9-4d68d33961d4", "comment": "Malware payload", "value": "130164111988e4ae89cf431f300dccfb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700492123, "uuid": "a8900a6a-e0b9-4361-847a-ff0616f61e1b", "comment": "Malware payload", "value": "cd91eeec1292f7a0490c81c14569dc2377b540698d5f7948671bd9ed5ba9941e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700492123, "uuid": "c66cc279-1414-4f5e-a174-c4f7c15e22c6", "comment": "Malware payload", "value": "eba43a7b2274db4ff6e8f0722f4fadb52e0e7eb0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700492123, "uuid": "f931f22a-db29-436f-b358-6d876d276106", "comment": "Malware payload", "value": "c3f516470ccda7fd388a6f3560d0ecb0a5a5e9bc4aa9c4ad808ba6ad595c80084ce998a2e605c17c8b2e9ec2123f2d77", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700492123, "uuid": "a95e2231-a4cf-4b1e-b79c-b69358e91810", "value": "T101C423E66B125236C23CABFF586351122B78926711E9E0F88FD41BC246E5B580FE5F31", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700492123, "uuid": "12b1fb0e-8a4e-400b-bc3f-9412df9a4711", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700492123, "uuid": "f8084058-833f-44e5-a4ae-6d29089c9460", "value": "12288:lvCeB6xaP51cXkHDpPwqcs3e3v/7I4cSLbie0j:lqeB64P51cXklBc6M/7ItYO3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700492123, "uuid": "d97005f4-39fc-417f-9281-2820b0dd711c", "value": 592384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700492123, "uuid": "3aad9b9b-8352-47dc-a2a5-f299870483a6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700492123, "uuid": "ad1f5984-d431-448e-a56f-13ad44694398", "value": "REQUEST FOR QUOTATION REF # 7304 - 3055523.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae21eaae-8781-11ee-8907-42010a9c0042", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1700470153, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700470153, "uuid": "80e59def-1d81-475d-8f88-1e039bcea340", "comment": "Malware payload (SnakeKeylogger)", "value": "0e647dedfa775cc5ed0d19860982a34d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700470153, "uuid": "8170a9bf-6634-42ec-ba65-7cf175b1f209", "comment": "Malware payload (SnakeKeylogger)", "value": "ce2069d49214c9cee4c60ccc51a0b9816ad8fc4446f5df75f313e3f843e8e666", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700470153, "uuid": "b43abd3f-1833-48ad-a16f-e898be1e27b3", "comment": "Malware payload (SnakeKeylogger)", "value": "05aca0ee0ac66ea0da11353f1c7b089b8f342eb9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700470153, "uuid": "508d7880-1918-42e0-97a7-de6934a199d4", "comment": "Malware payload (SnakeKeylogger)", "value": "01c791fe3a96a4040e18b77fce166d2f9d8128cd1dfb3d5e747aa0243d2662badf55e7597fe3084b713b71ff1194c1e6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700470153, "uuid": "30b12460-2e03-4c25-ba63-81057a1eec33", "value": "T1D7B4128132EA5B26E5F857F02EB2250507F2967AE973F3843CC624D13D66F448B117AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700470153, "uuid": "78bd0787-0af5-4aa6-bebf-0a3ae338376f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700470153, "uuid": "9019951e-c121-42b0-9e47-52c3b27576e3", "value": "12288:yuPkV6igNm0uAIXnGdfaKMCDU16EC45r8T8mUd/F3gMW:1yV0PojCDXECCmRoF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700470153, "uuid": "cecf1baa-19b4-4e0b-81ef-8b54c24b40d5", "value": 521216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700470153, "uuid": "12a5bb4b-606e-4d1c-9763-8bd3df61d8b1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700470153, "uuid": "634b044d-3c07-437c-8cec-1fa48bdc1cad", "value": "Bank In Slip.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "599db69c-8764-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700457556, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700457556, "uuid": "9050962f-87b6-47f8-a249-168c70a80f4d", "comment": "Malware payload", "value": "ce01b93b5fda977b455d6fabefc2c5ad", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700457556, "uuid": "2fc2ce81-63aa-414b-939a-d57dd9c9b0c2", "comment": "Malware payload", "value": "ce475db6671e2574765c9dbf1232f21b32099084af689c7069bdd92a83b3bf9e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700457556, "uuid": "d83606e9-f49c-494a-9350-02ff8209b780", "comment": "Malware payload", "value": "2c9174ea05fbdceedc5337ba2ffbd5ec4b0cfa11", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700457556, "uuid": "f4f171dd-b325-4cb4-bce6-50dbcc5b87df", "comment": "Malware payload", "value": "6b5c99b37c82aa3cf7789006a903bf231420033ed6a9aca44b4ece445d15ab24674139419c09b93bc25039c9570e6682", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700457556, "uuid": "c29a4a1d-da28-4172-ab82-8979236f31b4", "value": "T17F7402F0B3B2E463D1EA2631191697BABFF9EC13285B5B0923C0BB9CA571743461F245", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700457556, "uuid": "c8215877-de79-4224-afa2-f294f9c53d12", "value": "6e7f9a29f2c85394521a08b9f31f6275", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700457556, "uuid": "67376c2f-8995-4227-a3e2-3dd20254142a", "value": "6144:h3hqL36MLur1ChGoTgtKj2ekU1l/ZZ+nyCwHviSLR4:h3lrboTgtKj2ekU1l/ZZ+ny/PlLR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700457556, "uuid": "49ac1784-5d5a-4b88-9335-c1fe6339c848", "value": 346166, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700457556, "uuid": "a40fd2e4-cdf6-45aa-b4da-319a309db1db", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700457556, "uuid": "f997df7d-8168-4369-a9e9-e9f3f74c8ea7", "value": "SecuriteInfo.com.Heuristic.HEUR.AGEN.1337889.10177.32652", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "346f9bb1-8766-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700458353, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700458353, "uuid": "c53ae8f3-87b1-4ad1-8eaf-f6a25110c2e9", "comment": "Malware payload", "value": "7c4384670c75d733b4529f1460f265fa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700458353, "uuid": "cad4913e-b858-497b-aa38-42bd51a2ee4e", "comment": "Malware payload", "value": "ce5b6813839d02633018e7d1229810beced70084bc5b74b8c19c3424f197572a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700458353, "uuid": "26e069d5-fc4b-4d06-9255-41ea33fab1db", "comment": "Malware payload", "value": "036a72db76a2d7edfb13e6e6bc514a1a21b62420", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700458353, "uuid": "266cc0d5-595d-443e-b9ae-02b1d607b8fc", "comment": "Malware payload", "value": "a131d16fe6a334d43b30d6eb5ad4399002dfc0d0f48cd7dd32aaea9a66d89dc1c07c92ce5dab0b6fc0a627822036ad31", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700458353, "uuid": "52b4ab2c-4b4b-4d44-bdc2-9f44c5b1912d", "value": "T16B548C137AE1EC31C45383714F2CE6ECFB6EB8625D65874F23142E2A69302B2D66B355", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700458353, "uuid": "44759f6d-ac3b-471b-bece-91f9b5d00d27", "value": "406de49a03a07b95a2cb32358d5dae3d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700458353, "uuid": "830982a8-f1e0-49bd-bc72-6b481811318c", "value": "3072:iGzlkt37Bz/YvDP/0gppGRCbt1BMqrS6xChRXQJq47ovbeBE:/EtYvDPsg7Xbt1B3vx2SqMM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700458353, "uuid": "273726ac-6b45-4795-8d67-41fa2a48e43b", "value": 283136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700458353, "uuid": "9e861320-b425-4471-9edc-dc24ad9d0477", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700458353, "uuid": "caa3ab3f-b22e-4162-a5b8-7771e6f48bff", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a34131b-8773-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1700464107, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700464107, "uuid": "b0debe2d-e863-49fa-a086-4cc5fb7544c7", "comment": "Malware payload (AgentTesla)", "value": "cb27aa2a3d9a6eb79309fc42d5dfd224", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700464107, "uuid": "bad49281-a23f-466f-9b7a-0df7d35b847d", "comment": "Malware payload (AgentTesla)", "value": "ce791f710410ac66921dacd2e85c678fc19c6566013c4b5848ec13cae671fd32", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700464107, "uuid": "aa0ed8ab-746e-4048-a479-9520a03729a2", "comment": "Malware payload (AgentTesla)", "value": "c28805986ada6f9fc87631a17f3795cd266c0a4c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700464107, "uuid": "81a90e3c-14d5-433c-94b4-4794e67d238c", "comment": "Malware payload (AgentTesla)", "value": "d45eb0b09cd7664cba844df0213f7009500178674ea01af36307e833b0d3595a5cdf4be17d5a74a28793815494b677df", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700464107, "uuid": "0cfff8d7-a7cd-4747-a5a0-4a2123304254", "value": "T1ACD423CE95F498B3C9C953E6A81AC9B421A4FDC9DEA41FC14B1CC3D116109CA607ADFB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700464107, "uuid": "040f54b8-6d83-4775-b931-4f343e76942f", "value": "12288:gCaZkTYeFPQgvd0nJKHNToHP7pQCDNudDWXEIwAAAOfPNmjGe:2JeF4gvd0JKtToHl/DNuL8UmSe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700464107, "uuid": "9c7d9eef-956b-42c1-8d95-6d99320b4366", "value": 603255, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700464107, "uuid": "e2c76a61-a2fd-4df0-97fd-c98349a3ec51", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700464107, "uuid": "02472b01-d4b7-4cc0-a558-67b9342307df", "value": "QUOTATION PR1700212495.r00", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "221b497b-8796-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700478938, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700478938, "uuid": "737a1b12-2136-49a8-a062-00a75b24bbc8", "comment": "Malware payload", "value": "a332d8a6053b1ae3ed592eb3aa780543", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "vhd", "colour": "#219A84", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700478938, "uuid": "6c0616a3-d765-4124-ad94-fd0a31fd474a", "comment": "Malware payload", "value": "ce9ee2a4a764b29091c52700572e1b4e87d5321ac0b026e1bf7525f8bf61aaf9", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "vhd", "colour": "#219A84", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700478938, "uuid": "441a4152-fe2a-4e96-b761-2958ade6c2a1", "comment": "Malware payload", "value": "d5ac5c702be84cf8b4e1c845bc35efe27752b46b", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "vhd", "colour": "#219A84", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700478938, "uuid": "5300b091-02a4-4e30-b77f-331673762a6b", "comment": "Malware payload", "value": "7afcc2a3da962d672fe151a4a51adf5cccbc18db588a344fa05085407fb87691f18b98a375fbf7c0b8f1ac797bc57672", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "vhd", "colour": "#219A84", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700478938, "uuid": "bd46b673-cbe5-4f24-953d-771adc04b281", "value": "T1BD56CF20BAA1C236D8B715B94DBEA39A557EBF702F2451CB72C40EDE0E315D5AE30217", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700478938, "uuid": "adf2236f-cd8d-4d4a-b232-5fb5c717b400", "value": "49152:V8JYy3j5T+w+X7gJhHcnsZ9UwgV+UjgaebGz:KJYwTf67gHlUBV65b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700478938, "uuid": "a608d4ab-238c-4f4c-afe9-79a0420d3f44", "value": 6291968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700478938, "uuid": "d452ecad-360c-4f8a-a91a-bfda820e30ef", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700478938, "uuid": "fbc818ec-4762-49a7-bbd0-bacefcc419cf", "value": "entrate.vhd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44c7a893-87e2-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700511638, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700511638, "uuid": "2d575637-8256-4a4c-aea9-b375af332cab", "comment": "Malware payload", "value": "c5b76423675f8ef473225a753f0ce626", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700511638, "uuid": "86ee47bd-2f7e-4eb3-bfc9-a1ab34fc5735", "comment": "Malware payload", "value": "cf6d2322e1a9ea3d1b05171942922d5627b202d15ed33b9673ace501ebb47f92", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700511638, "uuid": "d2334627-1ac5-40d1-a944-6ca1b18c4a19", "comment": "Malware payload", "value": "9b2b1e499038247bc07cfc45eeff7f09d41038fd", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700511638, "uuid": "690daf91-9672-4825-b5fd-a211b85140d3", "comment": "Malware payload", "value": "38d049de3ffc7db3f164ac122a9089cfcaf17c7505bef9d86e0342c35675b6971b631e41e9423aac21e0ca47701e587b", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700511638, "uuid": "f4d4c700-4f24-4a27-90b6-8a9f92f5fb6c", "value": "T164156C0F3B9405A6F567933DC6864903F6F3B4061771ABCB0AE9466D2F63AD9267E300", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700511638, "uuid": "60a54a96-8514-4230-8937-5d3fcacffbcd", "value": "e6a5883a44ec58ac0a9e938d3f0cc874", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700511638, "uuid": "485f10e4-3039-483e-8fb0-4aabc8159b0c", "value": "24576:7Hw1hMtyAotPfwuIKDPIIEu9DKhWlOdZ7C:pKogD+ddE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700511638, "uuid": "4b29fa58-7855-4c55-ad97-31bfdc77f5e7", "value": 918968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700511638, "uuid": "0560a55a-5b4a-4e9c-bd21-f9f950a2ae24", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700511638, "uuid": "8b544499-f02e-46bf-bd45-f3b8e8aa8d52", "value": "ccupdate.log.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99c9105b-87d4-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700505767, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700505767, "uuid": "0a069140-ddf2-431e-a81a-cef177c53991", "comment": "Malware payload", "value": "86e0f62a58f3f6591cbc8eaabf4fc452", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700505767, "uuid": "933f58a7-8c18-4d05-909a-6ca267c428a8", "comment": "Malware payload", "value": "d14244378df2d9efab73e8e0b8236f8df1c38c0992db6537a0110305c38229e4", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700505767, "uuid": "26ce5cd2-9789-415e-a5b1-37550ff0adb4", "comment": "Malware payload", "value": "a46b205775bd409c8fd10d75b66731aa34688add", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700505767, "uuid": "17bd8de6-487f-4b72-9aeb-13804d4b3b32", "comment": "Malware payload", "value": "a137722b2233b17b8e10738ae6a349266b9a35faee2dc8ff5f6e65a37d0826c365b98f4d171cc70a704fabfa1a1a8c19", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700505767, "uuid": "bc9da4fb-9b30-4ba5-83e6-e63fe1624ff1", "value": "T1E495335867511902958B10B027CBF38228E1AF277F1465EA450E0B9C9BE2B5DCFFF5A3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700505767, "uuid": "5f77bb37-0a3e-4ad7-92fd-147bd757cf60", "value": "49152:aR+XIsA43yKgahSjIPVGkrnCVDVPYSWXzz4x:aWnA43tpskSF3WI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700505767, "uuid": "f5870dd6-509f-4f3f-9ec9-5765b4e9a106", "value": 1901674, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700505767, "uuid": "906c434c-3b2b-418c-ab40-7a1328fd2455", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700505767, "uuid": "05db6e76-ac82-4939-ac4b-aca929835f7c", "value": "rete.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62743bb9-87e6-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1700513405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700513405, "uuid": "33838977-35e9-4170-b143-be570ea80cd4", "comment": "Malware payload (Mirai)", "value": "6c7e6d40feaa9279685b536958c34de0", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700513405, "uuid": "f80d21b7-4d68-4c71-b749-a1fa29f7b72d", "comment": "Malware payload (Mirai)", "value": "d184277ef3481fe70cb5b8bea39f760241189ef1e59f7b3507329b15ae64b69d", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700513405, "uuid": "3c80bd67-6d32-484f-baeb-bf8a97f08a00", "comment": "Malware payload (Mirai)", "value": "ed8e647035615bb4c532d0831bb1369df5a0b69d", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700513405, "uuid": "4ebb822d-7209-4b13-8b02-75205393004f", "comment": "Malware payload (Mirai)", "value": "0ca6f4d0433dc68e634f57cec1c49e1e9ce7928d644505db7ca352540af1a0704a65620fcaa4b86a27073548494c70cd", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700513405, "uuid": "cf7fc8f4-d84f-4bea-b7ab-22ce2733e0e5", "value": "T1D01301F8C9C6DFD1C361887557E8C34AB38394BCB4EF37C9484A93F188D111A67996A0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700513405, "uuid": "ba64d938-dd28-4125-a4f5-27d166c46c0c", "value": "768:xY3YfFsuBhdLyRf8XR2ETBK716Eq3UI1LccmJ/aildyufG6AkSNza:2IfGuBhtcmR2mBU694SQdyiHmg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700513405, "uuid": "fb938346-ddb3-4356-889a-d05a3783b739", "value": 44940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700513405, "uuid": "253f595c-03e9-46d2-9d2e-01dafec6c5bc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700513405, "uuid": "85e77da3-52ed-4206-b9cc-81f593b49e74", "value": "cool.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9795261d-87b1-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700490731, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700490731, "uuid": "3d87abd9-d0f4-43bc-84fd-fc0cd0995e24", "comment": "Malware payload", "value": "50b2b692da0c363e301709a28b30afaf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700490731, "uuid": "d7f6401d-d10d-4056-8491-7f8ae0b5098c", "comment": "Malware payload", "value": "d25339ece508876c8900d27721f042391a4cc2769805afa377556a416a192c49", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700490731, "uuid": "0bb56564-a77f-40b7-b6cc-32c019fa1c95", "comment": "Malware payload", "value": "098e00413ba405bcc72b71a5869c2d151e93448a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700490731, "uuid": "9b5cd2cf-2d92-4c35-b0de-032e7e6510d8", "comment": "Malware payload", "value": "aa39d891e73b7943172f5051381d8b22e82075826ea2f0e481d9f7b8f4981673c64b6c991e29f4402049e593b25012f2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700490731, "uuid": "0c422fb1-1bff-44b2-802f-f4e9c5122e52", "value": "T1E263C11573E54489D5ECCE740D97B9B005F0BD23E5927B6F32C0AE6EAE73A82C205366", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700490731, "uuid": "9be14ee5-090c-42d8-af6d-29eb3a8db5b2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700490731, "uuid": "5661c929-e15d-4e39-a016-9a308765ac9e", "value": "1536:UJOjk0yzcRvVSfD8tzsy/jV49Gko0S/aATWJvQ3MJea9yn90+x:UJ70yK4D6P+YxpABJD9F+x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700490731, "uuid": "ac552166-ced6-4fda-8cdd-c4d9d64ebd6a", "value": 68096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700490731, "uuid": "2ed7acee-2b86-4069-a3fe-2abd3978cc06", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700490731, "uuid": "6dca1d39-3736-4f8a-9436-28bfe1076dd5", "value": "chr.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28c32e21-8767-11ee-8907-42010a9c0042", "comment": "Malware payload (Tofsee)", "timestamp": 1700458763, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700458763, "uuid": "29b5f115-d4fc-43bb-96ce-7b92c23e1567", "comment": "Malware payload (Tofsee)", "value": "265a630d864756fbb82d815a9dbcdce3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700458763, "uuid": "0486bbc9-1e7a-4719-91f7-aef7618b83c6", "comment": "Malware payload (Tofsee)", "value": "d30d636013a05ce0194abdd49b743ff1aa30837ae6d3f82796ca73395a3ee578", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700458763, "uuid": "1479c137-099a-4c65-89aa-5d6833e5db3e", "comment": "Malware payload (Tofsee)", "value": "27f5b008b3888f41288d5e0ac52c257f281ae19f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700458763, "uuid": "9f3995e0-3f46-4255-a0df-bf9e914b1b02", "comment": "Malware payload (Tofsee)", "value": "561b4e8784d39ae4eaf19af69fa6cd47a805547863be5a9c08c27e21634c960447929be6a57b7e01b5735b421e88e30a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700458763, "uuid": "e4510044-eaef-4f8f-9f65-84948414a6a1", "value": "T18014BF2277E1C032F12745308AB5C6F56B37BCA25B719DCF2B841ABE1E246C19B79316", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700458763, "uuid": "c5f952b5-ae44-462a-bdb5-9f210742e621", "value": "225c0a302d7e57a1c8187a7075db5d12", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700458763, "uuid": "ff99e92f-80a4-4431-be45-328932041ed7", "value": "3072:AR+b2wAmN64IOvAdjW6g/eNmJiSBpphw9UMIFgTOqZ1XvKs:Z2pq64IsQqR/TJfphvvyb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700458763, "uuid": "cbbce4db-3820-4131-b984-072c78de7dc3", "value": 205312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700458763, "uuid": "5d82f25b-d639-486c-bb63-8fb59d71b183", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700458763, "uuid": "501578c3-2109-4b8e-9017-4c2b0e2d9dbd", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c06bf60-874b-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1700446796, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700446796, "uuid": "106c66a8-6361-475e-9ab4-8741a261d3b8", "comment": "Malware payload (AgentTesla)", "value": "c9385145b9a3dd98c6c4a7595cfc15f7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700446796, "uuid": "9f5972ff-b725-4184-8b69-c2f6f0fb5904", "comment": "Malware payload (AgentTesla)", "value": "d5bee1b408958ac6304491317c08dbce37299575d911136a5cdad1d9ca5ad793", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700446796, "uuid": "4870c6b1-510b-4908-97d2-cb371cff2845", "comment": "Malware payload (AgentTesla)", "value": "15dd5d3304e41ae7586b90a4bc5861d69d1bec8b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700446796, "uuid": "843c2a24-bcec-4c5f-ac1d-c639ad51010f", "comment": "Malware payload (AgentTesla)", "value": "74c436eb4850af6037a7c3b8064cb89e2267b409aad6442cc255b8c342df480f9907008856e84608c26461681d7ada6a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700446796, "uuid": "cf923d1c-6dd5-4ca8-a38a-817e01fb52e7", "value": "T14FE423A53E2A4A23C7E864FD107639495771B79C4C21C8ADACD731EE89DCF448C06EA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700446796, "uuid": "52482668-5891-4353-9675-41549c4cc1b9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700446796, "uuid": "8b9befb7-2774-4130-bd15-2da651e04859", "value": "12288:Eg361h61EWGOXTnvAKZWOJpwOIu/gdbgyQTQBUhN10AG4no6nmP61:E1Y7GOXTnQkOJghQKH0d4no6mK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700446796, "uuid": "76fe88c0-d2c3-44ea-a21f-94e4f5aba668", "value": 659456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700446796, "uuid": "ee34027d-3b39-4e09-b8d6-bc5e459f4c3c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700446796, "uuid": "e05d2f0e-0b4e-45da-a250-58d0d3957460", "value": "SecuriteInfo.com.Win32.PWSX-gen.6112.16809", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0d352d8-87f8-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700521241, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700521241, "uuid": "ac83e74f-d852-4324-9d46-52e7c4ee9b12", "comment": "Malware payload", "value": "2cc630e080bb8de5faf9f5ae87f43f8b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Ryuk", "colour": "#C903C6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700521241, "uuid": "1ee875d6-04ab-4c86-bd0a-0d7681f1b74a", "comment": "Malware payload", "value": "d6b7b27e13700aaa7f108bf9e76473717a7a1665198e9aafcc2d2227ca11bba9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Ryuk", "colour": "#C903C6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700521241, "uuid": "e7198cae-7feb-4f32-90dd-3ab95751d887", "comment": "Malware payload", "value": "5a385b8b4b88b6eb93b771b7fbbe190789ef396a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Ryuk", "colour": "#C903C6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700521241, "uuid": "31a4a29e-f5e7-449d-85bf-55deaa55df91", "comment": "Malware payload", "value": "ab296aa1a6dd661902c62b56eccee57e81212edebb2d3adb46d6673ef0d5c56f45a92c15fa3c491142c7a1c58a1fbc71", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Ryuk", "colour": "#C903C6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700521241, "uuid": "dde3e973-d5af-4f8d-b9e2-6c0357ba434f", "value": "T16AD35B10F582C933F9F2453441E783622B2E6A302755AAA763C1293F6BB15D19F35B3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700521241, "uuid": "ef577cb2-5051-43ed-8c14-73a7e84f36b7", "value": "972d4cfc7d71d3451543278d1175c96c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700521241, "uuid": "acf148ba-3c5f-4421-92d4-a03dba7ea0b4", "value": "3072:j06qm9E8obCg2QdgYdrp23suV+eGg21Yg:j06qHnOg3df9eAJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700521241, "uuid": "0589a5fb-8a0a-43b4-883b-92b6a457b281", "value": 134144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700521241, "uuid": "644ce6ba-d2aa-4f21-985a-6b7b557e5906", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700521241, "uuid": "618f1edb-8a5d-4783-8bf1-188a5c8ac166", "value": "d6b7b27e13700aaa7f108bf9e76473717a7a1665198e9aafcc2d2227ca11bba9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ea0a61c-8777-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700465591, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700465591, "uuid": "ae481c45-c333-4a0c-b51d-5359965c70a1", "comment": "Malware payload", "value": "b97cd8efe960bd0477f340a890a161f2", "object_relation": "md5", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700465591, "uuid": "08410cf5-4b0c-4c4d-b143-7b13b423961c", "comment": "Malware payload", "value": "d720746c24de6868868ae6c09227da4aa5cf332fdd23721604f421a8efbb8548", "object_relation": "sha256", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700465591, "uuid": "b70f7281-f885-4a41-91ef-084764007bc7", "comment": "Malware payload", "value": "917ff1c0f175e12f5cf9d9b8f5c4702930632753", "object_relation": "sha1", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700465591, "uuid": "48b434c1-0572-4b7d-bd9c-8492d0164730", "comment": "Malware payload", "value": "f3c6b70360fbcb78568c34f865e7c8555ef6bb3f6428aba7ca91d90672043d969bc13398074419e2a8046212f263c3c1", "object_relation": "sha3-384", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700465591, "uuid": "b5815df1-aaf7-4c30-bdf3-9803a9b18dfe", "value": "T110C4239D91F489A5C9CB86B80B3AFD4C16EA7DFEC7AA154C4E9AB1C335C190F0882751", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700465591, "uuid": "de2b364d-1884-4e5e-ae3b-027f05e1bb4b", "value": "12288:+pDiUTdjiH/X7lOROrvhJfkVe4wVkcfnYMACcwEb8Ez8Jrm74mr1ljvS7l1:oDXpiH/X7lOorTJP//vW7oJK/ZE7l1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700465591, "uuid": "f35f99d2-f5e1-46a4-83e4-52a72c3e51d7", "value": 589092, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700465591, "uuid": "80df7701-6e6c-4a76-a957-d73ac5fb5936", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700465591, "uuid": "6794469b-b8a4-49fa-a782-3ade5b80dc62", "value": "DHL - Invoices - Past Due.7z.001", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc61c9a1-87d4-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700505825, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700505825, "uuid": "4a1f7a26-965b-4ee1-8cd1-b467efc90748", "comment": "Malware payload", "value": "63be1ee17d0ed41ff2478e0bd0998ee5", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "config", "colour": "#747DBB", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700505825, "uuid": "3d27cc98-cbb7-47cd-a57f-f42886aa837c", "comment": "Malware payload", "value": "d7611498ac3f820d16556e4743c1c2e028388d90608e610c1d06e838ff1114cf", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "config", "colour": "#747DBB", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700505825, "uuid": "533a59c5-8f82-4a2d-bff8-ada40bd6700d", "comment": "Malware payload", "value": "5738f39521138dc7f1109b345ee8c2745066a04c", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "config", "colour": "#747DBB", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700505825, "uuid": "dc070ad9-ac4d-4c8e-be51-c35645e6ede3", "comment": "Malware payload", "value": "4cc51ab5d2523e67624540bcbcdc99515a0a7048dc8b6f59fa2a2da15a39b073500044bd0948d7e780a1132c08d3163f", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "config", "colour": "#747DBB", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700505825, "uuid": "fb4cbf6d-d507-4286-bea7-02a19ede3cbe", "value": "T14F1523A1E34FE320F95790BCE4DFF80C11FA575787D959B61E2067CADC1081A2364BAA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700505825, "uuid": "ddcd53b4-1d52-4f42-ad13-4e391c52632e", "value": "24576:sxuM8fm/YPg+8GWKHM//c5vMppMm3l6c+gEmw:sxKMYPgWsnAEppMQn0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700505825, "uuid": "e8beaa6f-eb63-42e4-85ef-090a929124c6", "value": 953245, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700505825, "uuid": "5b3bd73f-43de-4420-9fb9-ea3a078b4d99", "value": "image/png", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700505825, "uuid": "df61ff80-4e89-44d4-b9b8-7006b431d999", "value": "jouk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a50d2d4-8764-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1700457557, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700457557, "uuid": "e250fd07-e6d1-41bd-a013-4ffa4501ffd4", "comment": "Malware payload (AgentTesla)", "value": "4753157b0f318cf7ff55c867652a1c03", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700457557, "uuid": "f8a88dda-c410-4529-ae35-cffec67e261a", "comment": "Malware payload (AgentTesla)", "value": "d7c1ff8739d0d26e441b0828edd8e77700a97d19231d1cf0dbb105735f793ef0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700457557, "uuid": "c3e2fd8f-67fe-47ee-94de-b683045ba2dc", "comment": "Malware payload (AgentTesla)", "value": "0d8919634e44de4590c392adf6ff76a8c1b22f43", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700457557, "uuid": "b9b9bfec-19c1-443c-9433-6d70c8f95589", "comment": "Malware payload (AgentTesla)", "value": "a8dda522878321776631b3dcba60474b68c158341478dd9accf4dc02fe885e7f8d296aa994fe0e04a5380bc4ead105ea", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700457557, "uuid": "adb98104-98ed-4088-9cf8-9ba8c66295f1", "value": "T111C423D933B58519DA24A73F563780424B329FE3F611CA7D2EC990BD4843B025F4FA66", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700457557, "uuid": "2e66422d-0c40-4484-a07c-27fa79fe99cc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700457557, "uuid": "b87e3f49-b8f6-4537-8ef1-7f97ebd15f91", "value": "12288:jytsJ8Ez0vCe4IJKfb7X5bWW7zx6u6FHPwSA9pT4Fb8dcMD6wTAOWmSLj9Vf:2qes7X5bD7l6PjiTIuc8TMVLjL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700457557, "uuid": "e0fdfbac-8c10-4033-b174-ef7284b7bead", "value": 559104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700457557, "uuid": "37f87ce2-e706-4dfa-81e5-9bca647565af", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700457557, "uuid": "c6d10567-3eed-466e-bb1f-abb0108ff364", "value": "SecuriteInfo.com.Win32.PWSX-gen.30886.6003", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7340f446-8790-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700476497, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700476497, "uuid": "2a6a951f-d6c6-4a9a-bb4f-111b0421e461", "comment": "Malware payload", "value": "fe91caccae9b8f57dc1aabc9743bc0be", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700476497, "uuid": "867acdce-d770-44fc-a372-f2ef77426f3e", "comment": "Malware payload", "value": "da37c1a83b8ccf9ca09c04b75406f57395928314594520fcc2696e493ab27db9", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700476497, "uuid": "599123d1-5005-4a11-9213-d87e1716e5e4", "comment": "Malware payload", "value": "84c31534d2fcc6a6346511155ab4af58bbb3b6b5", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700476497, "uuid": "f3170dd4-90f3-47f0-90a5-77036b428a50", "comment": "Malware payload", "value": "e63f48ea63380857672a1f85d88b19544948a3614a144eb8c0da27629bd6cf7728bea56f435df0e9e3323a56e1da7b15", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700476497, "uuid": "11ec0dc2-b4b8-46c3-9752-af0ff3ce1a5d", "value": "T1CBB412637742DB2DE0F38774A8AEBE75A0A69304A533658BE58C4F25B6F52070CDC05E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700476497, "uuid": "bdbb2e08-1d92-4b32-bf0d-ef861fc5a8cf", "value": "12288:U6/jFFhVBiAddGLcpWFW4pwHg0gw2YtmkP+ySwQ:U67W7FxgKwEkP+yNQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700476497, "uuid": "049d5822-3582-4b09-b774-8480adade19f", "value": 513895, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700476497, "uuid": "1db49386-c067-40d3-a328-c6827510596a", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700476497, "uuid": "878fcf62-daae-42af-9434-566e99bc9d80", "value": "JPM_China_Express_Delivery_Monthly_Tracker_-_October_2023_2023-11-20_4566505.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2870415-875b-11ee-8907-42010a9c0042", "comment": "Malware payload (RemcosRAT)", "timestamp": 1700453947, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700453947, "uuid": "d5f96055-b2ad-4f3f-a51e-6ba63918f7cd", "comment": "Malware payload (RemcosRAT)", "value": "d9d5f834b97ea925bb6d309bdda425a2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700453947, "uuid": "c119505e-a82f-4099-a8d3-12220e79f5f9", "comment": "Malware payload (RemcosRAT)", "value": "db4520e67b7388d613d17e7a0758192feda02f2951e3a3a2f5bd4f2c55efd7a2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700453947, "uuid": "f9ee201d-feff-43da-a5df-56debd17abe3", "comment": "Malware payload (RemcosRAT)", "value": "8cadc324173ea04cd8253ce621e62e2b164e8846", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700453947, "uuid": "3046ce59-c5d6-4af1-bd94-63531d6f58a8", "comment": "Malware payload (RemcosRAT)", "value": "697b25ca3cfdfa16b5078efaab093761d48dd159b133275ece6fc945480a01310b4fa3c66ee84b9b9d7439c022c94f2d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700453947, "uuid": "e28a581a-688f-4994-b00e-0138aeb2e07a", "value": "T15A1523E7F3A5157EC1E84772A02328684FEF23D6D402ED3D1D8D05790C723A29B666B9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700453947, "uuid": "2acf1cfc-aebc-4550-bcd8-b8e16bb94d89", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700453947, "uuid": "0e467c81-9883-4985-b5a3-c009b7c48404", "value": "24576:9qeVOdqkv6/FM3SHEg3Gu03F7ugpoe+vH77pd3HBI8y:9NV872FMCHE0CS8+vnpJHB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700453947, "uuid": "d0b55fd2-3dc6-42ba-ac84-4774cd235e2a", "value": 897024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700453947, "uuid": "fbb6e1c2-48c2-4549-95ff-0586131e2360", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700453947, "uuid": "953ea9ed-1268-42bb-b7b3-2fcb208e5910", "value": "SecuriteInfo.com.Win32.PWSX-gen.15871.29663", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3a05481-873c-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700440608, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700440608, "uuid": "c65e98b0-a9a4-4902-b0dd-09b4f65396da", "comment": "Malware payload", "value": "7f6d56318c066e1b62d59bb672671874", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700440608, "uuid": "ae0dd020-f68f-4b59-a01c-f7e683a12ae5", "comment": "Malware payload", "value": "dc83396015773f0d7abb3f7e7653cf048d44d267dc1332ddef21bc1ab302b6f7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700440608, "uuid": "354d907c-f47e-47f4-87f7-1801d991fd4d", "comment": "Malware payload", "value": "353f6868df838a6a59f750c3d326a410c6f9c625", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700440608, "uuid": "666b28c6-d86d-47d5-8f26-12fd0b021d89", "comment": "Malware payload", "value": "ea7cf0b264756bb498a706269d359307cf954383c3221f7ce9a0c5d89caab49cf5c9cac324337d83dfaeaf429ca48b60", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700440608, "uuid": "cd036f32-2485-40bb-b8a7-b478102924e0", "value": "T12D051842FE51E5C6C940CF314E9CEAE5832B7DA20E322707396BF70D6DB1A531E82665", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700440608, "uuid": "a759f5ff-3d65-4eb2-b23e-09c72025c630", "value": "1536:ZECq6V/DHfgQ3a9NK7BWQWjn/PVZf2t4fF6rBzDjc1FBFPqU:SYR0Q3a9UsQWjnbfgzDjKFfqU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700440608, "uuid": "6d946104-d5dc-4a23-ab07-94858d283abe", "value": 819200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700440608, "uuid": "3217db23-1a3f-4b95-bef5-c6a20e9f9956", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700440608, "uuid": "69803156-1ce5-4679-8edd-062ae2e11892", "value": "SecuriteInfo.com.Win32.Evo-gen.12676.2355", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2851f8b-87e4-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1700512708, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700512708, "uuid": "cd805384-75a5-4928-8411-e0a1e3169b75", "comment": "Malware payload (Mirai)", "value": "f8d0572cd864bb13d0033a25678f0d84", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700512708, "uuid": "7e6d42f7-9e6d-47ee-9fdc-d62cd37b07c2", "comment": "Malware payload (Mirai)", "value": "dd319b80dd2b7696823bd0c431d2d49b13ec58ce26c09ea65a323be6668e3ca9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700512708, "uuid": "fd80fcdd-4ad4-440c-880c-7bc1a21ceb0b", "comment": "Malware payload (Mirai)", "value": "58c270697a127e24b2a74de00f1ca7cba69f184b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700512708, "uuid": "72ada075-be2b-4767-a05a-d7757f6f5dc3", "comment": "Malware payload (Mirai)", "value": "0ced26fafdbe3ec3e1fb37a8b273a976c191bb27697469c3b661b74ce7bf75c92a47b233dbc5f061079d40a3c72b452c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700512708, "uuid": "421a99ba-d0a1-4816-a922-c462c1767fc6", "value": "T19ED33B46FA408B53C4D6177ABA9F42493333A764D3DB33068A18AFB43F8666F0E67505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700512708, "uuid": "78be5229-2964-4af4-ba4b-85bad87b03d0", "value": "3072:1v1GKtcCu9OzVbOD3o/kb9rL8dL8PlQOobeGT/M/9ie:R1GKaCu9+u4/kb9rLg8qeGTM/9ie", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700512708, "uuid": "def74560-b126-489f-8e38-052f025e3d03", "value": 137765, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700512708, "uuid": "083aad5e-fb74-4c52-a022-b19c7d8e67bf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700512708, "uuid": "7bd27f6f-2505-476e-9756-a4d815046025", "value": "f8d0572cd864bb13d0033a25678f0d84", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a05fa43-87c7-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700500104, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700500104, "uuid": "83feed0a-735f-4dce-a927-6e55aafff7d1", "comment": "Malware payload", "value": "74185308b206cc375c20f3916e5008ca", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700500104, "uuid": "f990b55c-727c-4525-959e-c590a153a8fc", "comment": "Malware payload", "value": "df54f384e18b3f92dd798cbc1437823f868d15282a549a5133e09851c2e198e4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700500104, "uuid": "0c8f5c04-b82f-4609-8a9e-5beff6928842", "comment": "Malware payload", "value": "98671ff73f75b51e3ac99adfe454f27f10d9251b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700500104, "uuid": "bf4f5c74-c437-4dbc-b36a-9e99f8422199", "comment": "Malware payload", "value": "25c7a6f4aa4334c3649894a015a5cb5f5742b7a280dd42856fc5b562fda901f48dd0982fddcedbdf53853b992b07a8ea", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700500104, "uuid": "1847d462-7226-4d51-9dfe-8405f8c4a980", "value": "T19E24C02177E1C073F26785344EB286A15A377C618B71DACF2B985A7E0E312D2CB79316", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700500104, "uuid": "58f3ec3e-0ae5-4a92-bbd9-14e4735f4014", "value": "238e0fa0f52afef2ef7eb9659d95319e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700500104, "uuid": "ee4ab8af-c7d5-4ac5-a558-d2d563b22d73", "value": "3072:fwUb8y4s7CwOygqYhwlRvGmezSFlI6b5K9qFjbvwKdj:dJ4SC/ygH2jG8FlIcK9q5t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700500104, "uuid": "de21f76e-b491-401d-937b-5c54ba67ddac", "value": 211968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700500104, "uuid": "2f6228af-bd1f-47d2-9488-203351b9fe9c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700500104, "uuid": "b5d3dc08-a495-4d9b-9c24-e41bf1e053dd", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6afd81c1-87b3-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700491515, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700491515, "uuid": "b1dad439-6419-4750-a3c1-c69b07a55285", "comment": "Malware payload", "value": "8dcc54de37eae021c5271f5f9a01616a", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700491515, "uuid": "09a921ca-ccb3-4981-91d3-8ef26ed1b2c6", "comment": "Malware payload", "value": "e078f924e0946f6942b9bb8b1cc951c60907fedb794169734370f429d66d1894", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700491515, "uuid": "165f5346-faf3-4604-8091-b4d50518c607", "comment": "Malware payload", "value": "d5932a2cb2bf8fb5b6e5efa5a55c6a8f3ac4b68c", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700491515, "uuid": "08264b06-104e-44b0-a222-39396e272b4e", "comment": "Malware payload", "value": "ce6572ec5562f37986aa864afc88d3351707741941819a02d89d8f6914a49642f1efb07380cf27f99bfd56194cc30878", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700491515, "uuid": "754043d2-7db6-418d-b89b-24282e8da2fb", "value": "T12E56C021BAE0D037D97306718D7EA32A667DBE710B3551CB63D40E2D2EB05D2AA34763", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700491515, "uuid": "184f43e1-6369-46c5-9570-db6e5d3fb6ad", "value": "49152:Nbezk8JYy3JDtzkvlpYbBTKPiD+MmR8JYy3iIDoncPieZo0g0IvHnfY:NbIJY2DtzrbtKPiD+MmmJYrID1Zo0Ug", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700491515, "uuid": "c04b7000-9861-40f6-af4c-84448aec8b99", "value": 6291968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700491515, "uuid": "efebb968-7ead-48aa-8cd1-bfd0bc16ff52", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700491515, "uuid": "67bf951c-8a50-4343-abe0-a05bc7903130", "value": "rete.vhd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "873545cc-87e9-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700514756, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700514756, "uuid": "e90a7316-6674-473c-a81c-0e84212d5a64", "comment": "Malware payload", "value": "d0266195f92dfa86ce1d825ad775c33f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700514756, "uuid": "14b7ff8b-0f92-45d8-880d-9417feb719a2", "comment": "Malware payload", "value": "e16c1dfcd46162a057a38ddc99698d28e9da15d37d15cce27dd49b0411f95556", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700514756, "uuid": "e7d2b863-9c9e-475d-be63-3de23f47a072", "comment": "Malware payload", "value": "29ec4ccdfce1cd453a3d300d15e943311d57dc17", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700514756, "uuid": "e3bbd7f9-1bf6-4755-873e-87a54d84d69d", "comment": "Malware payload", "value": "d8bacab96ac3b2bdcdce8caa23ca258f77cc2b30b02ff178fabb936e21dd04a37457a8e897809d607c144cec340c2288", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700514756, "uuid": "ae1eec8e-f90f-4614-a09c-96874648188b", "value": "T1B515CE85E50419A5CC5D5771AA32CE3512237DBEA878E66CACDE7D2B3BFB3835020613", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700514756, "uuid": "cf0b958c-bf7b-4321-8d62-ce501b5f3b8a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700514756, "uuid": "d0dda37b-68d9-4690-bc12-a18fa443eaad", "value": "12288:5TpbeQHucvCeAeQseQwk29e4gmLYOGsEOcNDjAqT3TakqpKjRg3vULBwXAP7r9ry:re4ucqeAete/k2XGzOGDtdjRgM9sA1q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700514756, "uuid": "cb09171a-92b0-4cc9-b7fc-056ab0f896ef", "value": 913920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700514756, "uuid": "61c52cc8-f8bd-4490-9549-7ee59b4c4932", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700514756, "uuid": "ea1f8784-e84e-4027-8bd9-b17af22cbdc8", "value": "Statment of account.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a0cb9d6-87c3-11ee-8907-42010a9c0042", "comment": "Malware payload (NetSupport)", "timestamp": 1700498413, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700498413, "uuid": "7aed06a7-acd8-4019-9c4d-950d25e2e08e", "comment": "Malware payload (NetSupport)", "value": "02112c6f6f894b3b1d10f24a9e76477c", "object_relation": "md5", "Tag": [ { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700498413, "uuid": "bb4cb155-2675-4570-931e-dc62415cc580", "comment": "Malware payload (NetSupport)", "value": "e262818591a54510401fead17928d0da8df02a29150ee319e86821a447505641", "object_relation": "sha256", "Tag": [ { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700498413, "uuid": "17ae8208-1307-46e2-9421-d72767707a06", "comment": "Malware payload (NetSupport)", "value": "d337353d5d71fbf8a64e75c1da442cf738e07fde", "object_relation": "sha1", "Tag": [ { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700498413, "uuid": "c802dc77-913d-45bf-b7d0-e72ed1c49e8f", "comment": "Malware payload (NetSupport)", "value": "e4beb0ce7c1a5a0db934982a3e457a3afb50e05fa050ce0d77d87b3305cd8abc999b170dda9403e3a614d8f4b06585a2", "object_relation": "sha3-384", "Tag": [ { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700498413, "uuid": "5569d68b-6046-4c17-b628-9375f2c77a57", "value": "T118C08055C25E8415C173BD17C6188C3D74A351A35615DC3073505D88FC5D45C2F4D6D9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700498413, "uuid": "5f6b1fee-135f-4cc7-a12d-d3f26dec7078", "value": "3:HRAbABGQYmaUMb74gKLRbwKIjRxwKIy9qe1YSo/QJ4ovstyYesbBSl:HRYFVmapH4P5wjbwy9ISoIJlvstyYesU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700498413, "uuid": "25f00f65-fb6a-45d1-917a-46da3c64e118", "value": 174, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700498413, "uuid": "bf45cd76-7b3c-4850-adf8-1587d556a094", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700498413, "uuid": "af9c5368-48a6-40c5-9b72-309f2354c1cc", "value": "13.url", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96f733af-8787-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1700472691, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700472691, "uuid": "38a2c851-064d-4df7-9a4c-dd19b7aa67cd", "comment": "Malware payload (Formbook)", "value": "43625f3626478bb6d67cb9f781678dca", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700472691, "uuid": "0dc0aad3-8711-42a5-b8ab-9dea7c217ec5", "comment": "Malware payload (Formbook)", "value": "e2f1744f34f39652ca8e448b29e6956e17a1100ab32948560b7bd848f2fa0bd7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700472691, "uuid": "556ce13a-0339-4fb6-907c-5e48e6934534", "comment": "Malware payload (Formbook)", "value": "39a3af1c00b03d92f6fd918dd26ac526fe735ac0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700472691, "uuid": "d8f62ce2-7346-4a1b-becc-316cfae10549", "comment": "Malware payload (Formbook)", "value": "1c1555735636fbb5dd2ef31b690e524d114708cca50c68030b4f3c39bf6c6ac5e743c04e25371b5626bab3e85371d4ee", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700472691, "uuid": "6cb04893-12af-4263-ad92-5996d73e22cd", "value": "T12DD4E152F34498E5E42712B598B7E4142133BF6E966A854D28EE372E0A7330710F7E9F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700472691, "uuid": "0a28a925-e162-43d9-9e26-561a02af6c9d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700472691, "uuid": "0de58ef8-af95-4d4b-ab41-42af9f531187", "value": "12288:EvCeeRUTzHBMQxj5BlaDWv+R3rHgTB7+6S++wsNG5/jaa4rPcyikP5k6kG:EqeeRUfjxjxaDWso5xwNw/2NViY5k6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700472691, "uuid": "869c991e-1d3d-42fd-9f85-b5d93fc80ba0", "value": 600576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700472691, "uuid": "4f8fc232-fe46-4541-a8b5-af2de6bc6ffd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700472691, "uuid": "a2586c4c-1e94-4800-bad9-2f4c6b733e3a", "value": "SecuriteInfo.com.Win32.PWSX-gen.31207.26757", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "781802e0-87c3-11ee-8907-42010a9c0042", "comment": "Malware payload (NetSupport)", "timestamp": 1700498409, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700498409, "uuid": "47faf4cf-2847-4a7e-bd0a-b0d55dc74844", "comment": "Malware payload (NetSupport)", "value": "f9f47ee485ebba35764af7399bd220d4", "object_relation": "md5", "Tag": [ { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700498409, "uuid": "4b8367f5-552e-4a67-a17d-77fad630975f", "comment": "Malware payload (NetSupport)", "value": "e30b195a1e0665699994b74686202c6e0bbf67d22c57a073b808e9e61d756a00", "object_relation": "sha256", "Tag": [ { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700498409, "uuid": "8e87ffc6-f237-4af6-a524-b03cdfa5f68e", "comment": "Malware payload (NetSupport)", "value": "038e7496c2fa157a2f27b3db513d1d803aa9d384", "object_relation": "sha1", "Tag": [ { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700498409, "uuid": "4a6bb968-d9ed-4c32-aa41-de1f98d2ff21", "comment": "Malware payload (NetSupport)", "value": "0a38c4d09424c1817da43f6f1a6301161caf4a7e16789517565e12c2e66e434f72193531989543cb6074a65fbaaa447a", "object_relation": "sha3-384", "Tag": [ { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700498409, "uuid": "40975b9f-f32f-4d1a-9020-e59f79bb491e", "value": "T10E152B05021EC836C4238C3C4D0CCC3DB86350451116DC3043502DCCEC438593E442C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700498409, "uuid": "c8d8759b-16e9-460f-ae12-651a062cfb4d", "value": "3:HRAbABGQYmaUMb74gKUWLKod1YSo/QJ5IIyYesbBS1:HRYFVmapH4PUPogSoIJ5IIyYesbBS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700498409, "uuid": "4f1281f2-641c-4f7d-be11-fff0d9892e15", "value": 874685, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700498409, "uuid": "8995880d-cac2-4778-a86d-a177514e6f02", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700498409, "uuid": "fddae416-7941-4e0a-8c93-371f986dfc6d", "value": "no-87BA93.url", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed7f4c57-8742-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1700443201, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700443201, "uuid": "aa0d21e4-c3e2-4528-a285-16f67ab6a933", "comment": "Malware payload (AgentTesla)", "value": "21758acbe90e8bd2b2a151d712dd416f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700443201, "uuid": "0ced10c5-4ffb-484d-b230-022f21966b06", "comment": "Malware payload (AgentTesla)", "value": "e3fbac5e9bdda86115eaab06baa09a9db202c1a660bc7b1d6bf6dde70db5ab52", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700443201, "uuid": "a29c45cf-4541-433e-bb76-415ff0b0b5bc", "comment": "Malware payload (AgentTesla)", "value": "7f85985d9d5f89f05e5f0675f2cc0b29f27c3205", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700443201, "uuid": "b57c2b84-bf89-43b1-b6ec-202356562b17", "comment": "Malware payload (AgentTesla)", "value": "0889670369541aa8c36011faeefa39a7d9c34d943c648aaf2a58093d2bfa710297fbe7da9b0046e0b738bfad3d655bd6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700443201, "uuid": "d4d36e46-f287-4e95-8da8-8bc22352c103", "value": "T1DCE423A9336059B3DFFDA5F66037B44103BABD795422CEFC2C8624CC6AD2B062609757", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700443201, "uuid": "a040ed08-7b32-4eee-b1fd-341695a625ac", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700443201, "uuid": "6e09fe23-75fb-4e55-aefe-d286a49fd8e2", "value": "12288:UYq61h61EWGwl8/rm5IelGuxhuuz8WRqjd/fQVyNP+GUt8HpCYUXlopbMRC61:UEY7GwlAFeA4Wuad/FNtk8HpCYyt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700443201, "uuid": "56aada46-7af8-4815-a466-670048eea6bc", "value": 662016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700443201, "uuid": "d09153e1-ce59-478f-9722-9f1cb61e9505", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700443201, "uuid": "8695193d-9977-434b-aa73-540c61fbc002", "value": "SecuriteInfo.com.Win32.PWSX-gen.9667.19392", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fe352b7-8773-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1700463875, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700463875, "uuid": "a1a241a6-3fd3-4fde-9ccc-a8328f3a6921", "comment": "Malware payload (AgentTesla)", "value": "422bfd2d85dd5bee8004526fa012df6a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700463875, "uuid": "5e0b149e-8a79-4ae4-84a1-3075b75e2ab5", "comment": "Malware payload (AgentTesla)", "value": "e49df0f66eb42b10494df1c1c8518fe9ab49b30df38b148c2158149d52a11b91", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700463875, "uuid": "0331b251-2079-45a8-9305-25790c0d9465", "comment": "Malware payload (AgentTesla)", "value": "0b06633d868e7fcf22d0532d2bf97f40a61ffe73", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700463875, "uuid": "7b6b783e-7c78-49a4-a57f-93237dff3a30", "comment": "Malware payload (AgentTesla)", "value": "3b47bbd622adecf67a5c486ccfbba2121e92e80880c08af4d83c8a0d0f0bebaf371dfc7148783792324cfcce5efe810f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700463875, "uuid": "260b2dbd-7792-46c7-aac7-80082c0c40c9", "value": "T179F4DF9C3610B1EFC86BC8728A982C64EA2074BB971BC613941315EDEA4D9DBDF151F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700463875, "uuid": "88bfcdb4-09bf-40e5-bf41-b19bb703f9c6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700463875, "uuid": "24331afb-eb2c-44a6-9a38-c36df8eb3397", "value": "12288:vjN61h61EWGy6ZbRjXUtxX7LXM3Q7H4C/6GhuOTNLItGvB+WGe35dM5mbp7z2atS:gY7GDZoX7LXCQ7H4o6GhJXBZ2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700463875, "uuid": "b41c8b75-c5dd-4997-939f-a036a0d05274", "value": 753152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700463875, "uuid": "139e3d7c-17a7-4f56-bcc5-8b9080de2c5d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700463875, "uuid": "7700c38f-d9d2-404c-9807-922ec794257a", "value": "NewOrder.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3c3f1bf-8779-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700466834, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700466834, "uuid": "d4863862-357c-4a63-aca6-c64b8ac7c7e7", "comment": "Malware payload", "value": "a566f68ba37d02334aa654053b4d7b8a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700466834, "uuid": "87fdc235-255a-4cab-80ab-494fcc3393ad", "comment": "Malware payload", "value": "e579ef01ba2f52a618ab1448543ea8646ea710cf168c64aff70f68e1c89f6cad", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700466834, "uuid": "a0aec33e-12b4-4daa-97c0-4ffeb703b965", "comment": "Malware payload", "value": "a679b488f61b2c4ef3bc3c65b959a2f771e4a388", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700466834, "uuid": "28a751da-2d74-43fd-add4-210593f8e8ad", "comment": "Malware payload", "value": "9d9994e375c6034dba06fee3b6f20ef75729c5eebd495133d29e9f08e8d5e698de6704b436576caf7d97fa3c6337eb69", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700466834, "uuid": "24d61582-2e1b-4b54-91f2-77f240334039", "value": "T1EAF42321A4CF14FAE6896D7B2462AB1ADF3B6400B9B4D01E0F18D1776D35B27CBEC191", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700466834, "uuid": "577f0cce-c253-49f3-aff8-f37018777a91", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700466834, "uuid": "3ebae5b4-2ecc-4beb-bd04-58204badcedf", "value": "12288:o33WouuBciq9wBbSrMFs1xr5zVgUJO3Hf8aYhA0jtJlcqOO/T3C1DPfXS+7vF52z:u3suBvq9gIVXgUJkHYA0LltOOr3C1zCV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700466834, "uuid": "439f33c4-14a6-4c57-b9c1-9a4edfb1670f", "value": 774994, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700466834, "uuid": "82535d14-f853-4881-997e-9708d81bdfa9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700466834, "uuid": "77b73321-832d-46b7-9c6b-055e9f70c6e0", "value": "NOV#PROFORMA INVOICE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e36110c6-8778-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700466377, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700466377, "uuid": "d1b5ca12-2fab-44b2-9214-50f421943e76", "comment": "Malware payload", "value": "9fcf670575bf342337d9b324ce61952c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700466377, "uuid": "fc35a529-2219-4a3b-bd4a-20e849c31bf6", "comment": "Malware payload", "value": "e61cc9232f853e36e08fce0fc9eb10cf89558357343f5e91eb0603ed94902560", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700466377, "uuid": "6a172169-9d2f-43ff-86c8-99ec4363d802", "comment": "Malware payload", "value": "c21e7b637db2081199a30f90c95589c1dc74d116", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700466377, "uuid": "5e3909a1-3998-4c7e-9cda-b85fbea5f1f6", "comment": "Malware payload", "value": "9c510f53112f2fc4c56d1c446695d89252f6f6d6e5cbbb749d5ccfee644068570288014828b38d8733450ce3c7273656", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700466377, "uuid": "eed3e79f-80f8-4b5a-8c98-86d872e38d87", "value": "T1DC45C603BA478BA2C179673BC79AC80C8774D5816713EB5B398A2BB91CC37B75E41607", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700466377, "uuid": "7da1ca61-9d2d-4015-801a-3b6e0d12870b", "value": "12288:WJ7T2Y8l/NbIe/1LAmUQ98W6bg4Sf9JTOU7ZayZflBWFqpA9nIF86B3QwMRCzdsg:ajOB/10fQ974g4mzT7wyq9siWhV6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700466377, "uuid": "053ad6ef-a170-4f4d-898d-75e34aa03406", "value": 1252864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700466377, "uuid": "f1a25d9d-8999-42c0-ad8a-4c3f42a571bb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700466377, "uuid": "ed6a1f00-605b-4da0-aea5-4a151760b517", "value": "RFQ#4123060 - TAG# 01FCV-27601.pif", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61ba37f5-8777-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1700465730, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700465730, "uuid": "6451ef08-e45f-432a-a056-1a5bbd60702a", "comment": "Malware payload (Formbook)", "value": "9581d007a33277a7c16ac8b24d88f39c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700465730, "uuid": "23760913-4c18-4d29-8e66-ca83e21cc362", "comment": "Malware payload (Formbook)", "value": "e73e3b7eb6cd581f436d7b1529005f177388a079a47c5dc51a7bf53da80f0b79", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700465730, "uuid": "79a19706-05ce-436c-8bc8-dc683eb66207", "comment": "Malware payload (Formbook)", "value": "92c8200359aae93e8613be7229160e63e5aa40c5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700465730, "uuid": "769db64a-46cc-4406-a03f-5afdb160fefb", "comment": "Malware payload (Formbook)", "value": "4105335f1c3432d5d101d54329b8787331201927a13503cc8e4f9d61dadd37e63bfdf174164b69f9d6cc57346f8d0fbe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700465730, "uuid": "c0659568-6daf-4df8-84f5-5be92af6291a", "value": "T11ED42308747DFB7ACCB46BF840342B5407B3E14A70A1D6585EC7B1DB6A23F160AA1E5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700465730, "uuid": "b123a73a-8d33-4ab9-90e7-41c3698319d8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700465730, "uuid": "272ce5f4-2368-4af4-b23a-25a77a0c0372", "value": "12288:TVMcthmJnysjhFIkemUWGhbIofdrJuHYXyZyKC1JexZvDIW+VAFnS:ELE1zo+yZCiNcqS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700465730, "uuid": "262a6902-b4d0-4131-9b50-2d357e180ae3", "value": 645632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700465730, "uuid": "1712d0fa-748c-4360-b947-3bf1258b23ef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700465730, "uuid": "ac580598-330b-4bb7-828a-dce2e5296ea1", "value": "S00989282313413.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8629d741-87c4-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700498862, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700498862, "uuid": "203cc6fe-861f-445c-893e-18509589f2e3", "comment": "Malware payload", "value": "7715d853d2e402e9dfae91f7c81f0fde", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700498862, "uuid": "a182fcf3-8371-4338-a102-963e64116887", "comment": "Malware payload", "value": "e784559d091987e91ec7c2a15f25531bc3010f838049b3acd3ed87ad7b4619e3", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700498862, "uuid": "c4047ddc-6b80-4671-95c3-d0d784551545", "comment": "Malware payload", "value": "c72d2bd5882d47d4ef9f0e66a5dca4631ec227f5", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700498862, "uuid": "b987badf-3096-4d0f-9044-0d3abac69cae", "comment": "Malware payload", "value": "87affbcda41859a80fd94863f29dfff61d5432128fb02e85b8caf9b1fbd7e0259ac531defccf9d3963fecdf772a518ef", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700498862, "uuid": "970b0d89-440b-4834-bb81-9a5cb73324fc", "value": "T10F3601957740D43FF877743219A6222633CB4E078A8F864768B47D1C6A7B2DC0F99AC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700498862, "uuid": "28959680-487b-4511-886c-59cb1e7f1e89", "value": "98304:wK7Esrj+xgZuIQjB4+AlI6r9suZdnbkOTbnrZs9DNzRcZd9LRZ7t:wfxjIMGFKVkbJbnrZsrNcZdRt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700498862, "uuid": "a555aff5-a92c-4842-9d74-71e4f6549513", "value": 5275748, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700498862, "uuid": "b86a99d9-cf8b-46fb-bb24-c4a7f9880a5c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700498862, "uuid": "4194e0e2-4f45-42d9-bcaf-b8f8e93b0f59", "value": "CourierRequest_signed.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8bf44f2b-87b1-11ee-8907-42010a9c0042", "comment": "Malware payload (Loki)", "timestamp": 1700490712, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700490712, "uuid": "17af430a-f094-47a7-89f7-6256c447ff2d", "comment": "Malware payload (Loki)", "value": "083b1af53ba0a7406195f5a592c8097e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700490712, "uuid": "e4f2d74b-333b-4b0e-9520-41d7aa824b6b", "comment": "Malware payload (Loki)", "value": "e7ec3396aede8095c2c834212499f1dccb475d7456f20043325518503de83f49", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700490712, "uuid": "51fa7c53-e5d7-4758-ba3b-48f7fc233c2e", "comment": "Malware payload (Loki)", "value": "a3aaf49572e6981a7d2536abb2ed3ee5f3d2390b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700490712, "uuid": "04447db9-9182-45b6-9e3c-8f19fc94891c", "comment": "Malware payload (Loki)", "value": "b3a2fa8afb7103efa050b1d60b73f6acfeb4e25f3c92d75e50e94be3279cce2b709e2aaac64888523d0fbe221b44a237", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700490712, "uuid": "d4589675-5387-47a5-a8a0-706b08fb29ee", "value": "T1ACA423B962B02168D8EECBFF4D4171004BFA5B97A93ACB4D6FC4216889633735D85B70", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700490712, "uuid": "13af1e6e-9b2f-40dc-8c14-bb87c6b99daf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700490712, "uuid": "aa17a66c-4f10-452e-b5cb-2e70fdb37977", "value": "12288:oytsJ8EzmvCe9esuvMfRD9KrknDk1I8sCtNfPvHoAx7HAVnM:5qeCILnD98rLPvoAFHAlM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700490712, "uuid": "8a9ca540-192f-40d9-a61e-9f9b417697f6", "value": 483840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700490712, "uuid": "ee3bda5f-fe05-4042-b724-0208208c7dcf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700490712, "uuid": "98191995-f7ec-4712-ac54-d098be3d2256", "value": "New Order-List.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a34ee13e-878d-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700475289, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700475289, "uuid": "8cb13eb9-89a6-4cb3-a552-680ac0d657cf", "comment": "Malware payload", "value": "0b29e56bfb2b4e7c18455a94578faf29", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700475289, "uuid": "26fd4296-4446-4110-bb12-78e37b7af3e2", "comment": "Malware payload", "value": "e9e234d7157a52297e215e3a57b2fcfc66375afb02cbc33641f625cbe6bbe763", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700475289, "uuid": "f1877793-b236-45f3-9caa-ddbef0a44ab2", "comment": "Malware payload", "value": "39d2e87b23c5d58394e19dcf69b026d2d606cc32", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700475289, "uuid": "75869864-56c9-41c4-b10e-9e36335677e7", "comment": "Malware payload", "value": "3f1a4a136af8b78bd6b66a5e3f2d81df07b33f4acfde5ef3e794313e5294feeb8748d99cda3b4ab39e89d965bc98e053", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700475289, "uuid": "4e8a0c96-804b-413d-9c8b-51946f06adc9", "value": "T1BBC4231A034F6737F629D3B317AB580E132A661E66DCE19F2CC262C76B417064DD2673", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700475289, "uuid": "1c67c209-2ae8-40fe-82fd-85ba01212b1d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700475289, "uuid": "d1da394f-0772-4b31-89bd-4db3b63f95c1", "value": "12288:NBvCeXIazREB4dUraAg2Wfq+XyBWj7B0conrIgt1enAM+j8:3qe4j4ig2iy67B01rJt4AM5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700475289, "uuid": "9b38cbfc-959d-423f-b7e9-4355273e405f", "value": 588800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700475289, "uuid": "63cc05e5-9a67-4f2b-a8fe-523041e3031c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700475289, "uuid": "95e835d7-03ef-4628-aff2-16646f2a593d", "value": "SecuriteInfo.com.Win32.PWSX-gen.6451.2880", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72ba0080-876d-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700461464, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700461464, "uuid": "9ab9c79e-85bc-4fd0-a9f9-b6f8f2bfac4b", "comment": "Malware payload", "value": "68392cd3b6d0900a123e3c474737a068", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700461464, "uuid": "0a9cd202-3c82-4b93-b3d4-9f9cbef55e3c", "comment": "Malware payload", "value": "ebb20ee3f9c28aa7e7a1fe1cdc8371c56a17f2f17bf8d98139fea30915e2be0f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700461464, "uuid": "546e99a6-62bf-400f-b627-763064c17226", "comment": "Malware payload", "value": "dcf1be955e9c6edc2e840b801173e900fad0bfff", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700461464, "uuid": "c03875b3-e9c0-4f9d-96e3-f7f35f2c4118", "comment": "Malware payload", "value": "b1cb184a3efa860e63e54029e06092052084e4e6b325a954bc703b065b31abe742e08dafeb093f74315032ebfe6ae347", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700461464, "uuid": "90fe102c-8c82-4566-988f-513382bf622b", "value": "T1EAB412A55900AC33D50B4D3250DD8D359EBAEAC22E9545CF23DDC15B4FA23F226E922F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700461464, "uuid": "03e25e32-27ce-4dee-9f82-616ef0219ae7", "value": "2fd03c0e50677cbfe09966e474b427b5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700461464, "uuid": "c0d3331f-7c9b-48a3-ac77-fbcea1c39f01", "value": "12288:sqDRPOurL2/zntKd8TeaqZiKi4ZZTbnTCWSuEfDSjEITXEbbkVKB:PDRP5P2/zMaqZiKdTIuy4obbkVKB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700461464, "uuid": "b42b99ff-1723-4d7f-9216-f67bf68931d7", "value": 511428, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700461464, "uuid": "659c4096-ecc2-4c9c-af8d-9e16b951859f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700461464, "uuid": "3f4c2c6a-04e0-4c86-8478-d53133910338", "value": "68392cd3b6d0900a123e3c474737a068", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5656015d-87f8-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700521116, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700521116, "uuid": "e943643f-8f03-4b3c-b5dd-ed36db397138", "comment": "Malware payload", "value": "ba9210de03de945901f02792f7994871", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700521116, "uuid": "6bab0264-778a-408d-9753-8d408ba44fae", "comment": "Malware payload", "value": "ecfb5c95d0f3d112650ef4047936e8fa5244c21c921f6c7a6963e92abab4949d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700521116, "uuid": "87d079b1-12af-4abf-ac3f-0c3485f456ca", "comment": "Malware payload", "value": "20c4569cbb6f2650b02f6a5257faa8a8dfb298bd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700521116, "uuid": "6235c967-fc91-4107-b8f8-5599849ffc13", "comment": "Malware payload", "value": "7c715ed80a3cb37488a5775e8fc91f245acb301337a8078492143a6272f49021a53753b8a22f76df96f0b5b061e2bd92", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700521116, "uuid": "7ed78ffc-4c1b-4ea6-8311-ded5fe50d63a", "value": "T17C337E14A3FB8225C42F1FB5087452D203B3EB92553FDF4E3D8D215D5A63B998B60762", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700521116, "uuid": "9d1b62b9-03f2-423c-8542-b4b71b40014d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700521116, "uuid": "a9e16bef-c150-4ed0-8204-5ece4e04f1e3", "value": "1536:EJJRZQJes5b0k5bbyu6hXOKJrkH6sNNW:oJRa4kLmNVOKJIasNE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700521116, "uuid": "f698d956-b9e4-4cdc-a07b-7796205d8d46", "value": 53760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700521116, "uuid": "70098ab8-9976-4f61-8a6a-7b0f6997fe7d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700521116, "uuid": "2dc24704-3e41-4f10-90b7-139f6a526094", "value": "ecfb5c95d0f3d112650ef4047936e8fa5244c21c921f6c7a6963e92abab4949d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "867e5af8-87bb-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700494998, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700494998, "uuid": "20742c02-2d8b-4e95-9c52-1edc67965863", "comment": "Malware payload", "value": "233f382c6f7e034b6588fdd07dae612e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700494998, "uuid": "fefcb81d-ea27-4920-b599-244f8978c350", "comment": "Malware payload", "value": "ed414c5cd76f7735a701b3c734bc8b7fc0d21e2143eae7925e57451d49b256ea", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700494998, "uuid": "2546efc1-bdfe-42f8-9758-58f9b652b9a2", "comment": "Malware payload", "value": "fe5abc8495a6bd9643bdabd9463a6d1800fd9f39", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700494998, "uuid": "2276cf68-dc59-4b41-940c-ca038fcdf0e3", "comment": "Malware payload", "value": "11922b784c6a2f7b09efac4a186fce0a5be737866bdd0112cc1a5ec60f46909f42986377d0336657bfb060cb022986a3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700494998, "uuid": "79671c3f-0340-4975-aeff-db838a5eb8a5", "value": "T10055E703B66649A5D7869736C5E70E091B6AEC8123A3C71F398A335D29337FF5E42603", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700494998, "uuid": "57dd77f9-62b3-4548-8fc5-bda7b92c1b4b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700494998, "uuid": "30b60c6b-65aa-4759-af86-fa92c0535e5a", "value": "12288:+FJyQvvYEoIkcGUdLJWsYdt41FoMUcj/0jFSbvcv2Y2XxRkz9BhnVH:+FJyjEoI/GUFJKdt41hLBc2x2JBhn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700494998, "uuid": "357d1116-34b7-4666-a90d-38cacc7d3333", "value": 1362432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700494998, "uuid": "5cfcfdeb-1f24-4af6-a831-6456c7b5504e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700494998, "uuid": "d53eaa48-ba7a-4a94-9d54-d87f155b9fc8", "value": "QUOTATION_NOVQTRFA00541\u00b7PDF.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8db8cfd7-8770-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1700462797, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700462797, "uuid": "bc8042cd-8d49-471c-bb00-c6192ea0164e", "comment": "Malware payload (Formbook)", "value": "8b2df1b36406eae2af3c5055a88acdd3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700462797, "uuid": "4867fd7c-f1f7-4748-8278-6ccfdf75d0fc", "comment": "Malware payload (Formbook)", "value": "ed634911cd271d95fde0200d57e20a5d16a33580ae196d97efcc8b3002a5ebc9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700462797, "uuid": "142f4e44-3912-4d1e-80df-4788e43ef79e", "comment": "Malware payload (Formbook)", "value": "661f3d1c05d90950d65062cc525bfd9788761012", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700462797, "uuid": "05019bbb-fa0b-4aad-a106-7bd1d15aa49f", "comment": "Malware payload (Formbook)", "value": "98948e281c7cf29944721458120c2c69a66a5ffd7fdb12cf3001867dce198d06736213ccab41f7864c8dd753c0a196bf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700462797, "uuid": "178ba9e5-757b-46bc-ae57-f8bcb457ad2f", "value": "T190E4232A3F64D6A3C6CA80F510B57E9057B3FA589C11D8FC5ECB21AE098DBC65203A57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700462797, "uuid": "3338f555-c3b5-485a-9a8b-a0656d6f9f44", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700462797, "uuid": "b67b2e52-2c8e-4dc9-aaa4-60072e316d7d", "value": "12288:eC361h61EWGfPJdtu24qbVTrMgKNI94EOTE0+M/NZgsD+5o9jwRbUcqn31Z61:eXY7GZdo2NVo694EO4E/ksk9ocq6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700462797, "uuid": "de5861e8-74c7-42be-901b-5edc84cac904", "value": 669184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700462797, "uuid": "61ab126b-c3a4-40d5-807a-8e30208d9eab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700462797, "uuid": "519bb93d-73af-44c2-8618-984b07f38cc8", "value": "AWB 9899691012 Clearance Doc_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3566a85-8780-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1700469706, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700469706, "uuid": "6c32f790-79b0-418b-82f8-dc373478450c", "comment": "Malware payload (AgentTesla)", "value": "9c8de8e748f9c692ba2c12276e615f18", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700469706, "uuid": "e23e63aa-73f5-419a-9ebc-67614935a93f", "comment": "Malware payload (AgentTesla)", "value": "ee226ec9420fd022ce8bf7752432ab32cdfbb6ce7c03d2d96618c67bf4bace08", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700469706, "uuid": "168408e3-6c5b-4e38-abb6-e88a2c61abf9", "comment": "Malware payload (AgentTesla)", "value": "1a288b06dd00bcb2e518fdff49b5c9ffce909fa8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700469706, "uuid": "f7dcb7a1-22a0-4756-b594-f7c0a70a251a", "comment": "Malware payload (AgentTesla)", "value": "c433a47e76e068cca7a2d601925c1bda03bd10ce55d7c3a27a66ab23310d8809fd49cfbc24c9fae4c2cec2cb6870c069", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700469706, "uuid": "1dbdefbc-0a17-49b5-964f-1f9a65fb3abf", "value": "T17505F0003B746E53CBA286F85766249C7BF47DA69161EBFA1FA270CA34F1F704205A47", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700469706, "uuid": "31b99b50-a99a-4e79-b647-3a53d58c64a9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700469706, "uuid": "e138b07e-5843-4972-9241-51f7a55f548b", "value": "12288:mZvVBQYuPx9WsWWnxSk0mSjP54QFAZBf8SCVYKJveEDYY:YvEjzrxmF4Q8fSuK1Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700469706, "uuid": "2daa82a6-2f09-491b-b58a-739a8f715404", "value": 803328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700469706, "uuid": "3dfd8d4c-7698-49d4-8ced-9d2f4afea0e2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700469706, "uuid": "dc3d5c6a-90fe-4755-be4a-5671b5c54828", "value": "S\u00d6NMEZ GLOBAL YAPI VE T\u0130CARET A\u015e'DEN SATIN ALMA S\u0130PAR\u0130\u015e\u0130_xlsx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1db53910-8774-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700464327, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700464327, "uuid": "a107e682-3c8a-41dc-9b6c-8af8dcf053b1", "comment": "Malware payload", "value": "141f9d07b2be477f081282e093c4fcc6", "object_relation": "md5", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700464327, "uuid": "8a3ec39f-2d9d-4b54-a6d8-c0690ba78e1c", "comment": "Malware payload", "value": "ef5aa598159a68e28914512876cbcea754614aad9679234fd6b93fece2901367", "object_relation": "sha256", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700464327, "uuid": "cc428cc6-22b5-4458-bb9c-005040d6fe45", "comment": "Malware payload", "value": "296fb6093252b9d7c1e90565523e7e2e51ed078e", "object_relation": "sha1", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700464327, "uuid": "9a5cdff0-dddb-4005-8dfb-ebcfce74eb60", "comment": "Malware payload", "value": "d28e4a43ba11027e58de8e89730f7216c9b3107c5a646dd4bd3b7211320a1a21bf8d24968109afab5a3a3b53a41beca5", "object_relation": "sha3-384", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700464327, "uuid": "20f8855b-44da-468b-8b4e-f76c475a89da", "value": "T12F237D003798C136E6BD4BB5ADF2E20582B5D6676D03CA5D2CC810EA2B53BC5D6136FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700464327, "uuid": "b53242ad-cb39-4b67-8512-09ebb114bf71", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700464327, "uuid": "72deec25-a6f0-4296-8887-b92e338cca09", "value": "768:xGq+s3pUtDILNCCa+DihhFxhLR5qiHMYbNge/v0+k3qwvEgK/JLZVc6KN:8q+AGtQOhjxXDDbad+kTnkJLZVclN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700464327, "uuid": "27f5cfa3-3d7b-4817-9f3d-c0821fb423b0", "value": 48640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700464327, "uuid": "4f5ce2ec-5062-4879-ae2a-8fd9e80e0007", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700464327, "uuid": "e6c7ef3d-56ed-4308-a5b0-799b6c240f01", "value": "170046432657dc011880b52c09340e37321ced25e48e8219c8f2883814f0d9e7d53b547691196.dat-decoded", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2a32ba9-879e-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700482616, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700482616, "uuid": "a1e6ca44-0cf5-4e56-8523-f647875cb017", "comment": "Malware payload", "value": "8dafd45563656e015a2e1391b567acd7", "object_relation": "md5", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700482616, "uuid": "46e9a7e2-2c02-424c-bf6f-2c9589b2c8e4", "comment": "Malware payload", "value": "f0a961fad3b4e42f91064be5d5d44d0770254db63dd2ae6477822e0ae76fd953", "object_relation": "sha256", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700482616, "uuid": "38d38eb2-4980-4779-a86e-e988c65a2795", "comment": "Malware payload", "value": "b07c52041c766823d220da3e4ce73f61dcd30c34", "object_relation": "sha1", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700482616, "uuid": "a6626c3e-97f6-4e13-9c29-d3d52dbfc4da", "comment": "Malware payload", "value": "920b4f5bf5bbbc562671f63690671cfd0879697d89ca1ff08684a31155d70cf02f1f9a662fb9b626e9e8b782efb30b8e", "object_relation": "sha3-384", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700482616, "uuid": "b99a677e-fc56-45fd-848d-2373ef88499f", "value": "T11CC4234E7F06C287F56D7BBAF217A9C509B2E4D9B676BFA016F6271C2B4035804AC04D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700482616, "uuid": "908d46b1-4c03-43cc-822c-8b8ce0b75aae", "value": "12288:mTxzNF7FKdRWkKyt1slZEUkpjcHCCiSBpRtdl:iBYWk1sTJkJKCCiSDRTl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700482616, "uuid": "e13e81af-6f54-4ff4-902a-7abffce6c375", "value": 577313, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700482616, "uuid": "0462eaf8-19d2-4f58-97c5-be360ed658ac", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700482616, "uuid": "40b274c3-0ca2-4fa0-b388-e60db7b518c0", "value": "Erro in Swift copy.7z.001", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4dc217b5-8779-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1700466556, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700466556, "uuid": "00f9050c-ed3f-40af-a904-0deeb3339c38", "comment": "Malware payload (AgentTesla)", "value": "09a0b75c7cc7b5578ef4d9f2f2973a19", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700466556, "uuid": "d8d6f9d4-0fbf-48cb-a4e4-2d588aef5b29", "comment": "Malware payload (AgentTesla)", "value": "f2440193b4e09eb4cc992627b414a672b9f409d5ba3a6ef90d224d0480286dbe", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700466556, "uuid": "032c13ca-953a-4758-857b-db155f7b1199", "comment": "Malware payload (AgentTesla)", "value": "8258b5b284ce6bc650a2579de2ca84ae5a814762", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700466556, "uuid": "653c7d3b-6322-4b7d-b2f7-6acf9e37eb0c", "comment": "Malware payload (AgentTesla)", "value": "b6bb2dccc8d4b5dc75eac0bb9c45888fd45a728487ef8a0a81c14c6785ad9c36189196396b29a56539efac7df2d22d5c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700466556, "uuid": "eff679e8-535a-4086-b9da-e1a82037944b", "value": "T1B0F4022533949A12D16E03F9992A019457B5AD23A421E31D1ED33AEE1F73BD18F01BFB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700466556, "uuid": "d6e6f099-0648-4d49-be1d-8de9738ce305", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700466556, "uuid": "faf1989b-2786-43b9-9522-97617ed36ad8", "value": "12288:nijW180MWXGCt4hLKZuYbTa6EHC40hOv8bOKRINNT0g1J+NxF:P/t41KZ5na660WcOpNZQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700466556, "uuid": "f93a7dc8-7d3e-4383-940e-4b1a6424ebdf", "value": 763904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700466556, "uuid": "72ec37cd-9c90-4495-9971-6b5fc606d199", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700466556, "uuid": "ed0e92ec-51d4-4458-be51-555825cf398a", "value": "14-11-2023(1).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5affd57-87f7-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700520927, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700520927, "uuid": "696baada-4ea1-4d91-96a8-124f0fd87551", "comment": "Malware payload", "value": "511aa2f2fe6196e032ec7fef83bb8d95", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Locky Ransomware", "colour": "#2274EB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700520927, "uuid": "4636a15a-d059-4228-ac06-800695618bbe", "comment": "Malware payload", "value": "f2c9ae3735430b930a81148c0bb470fcb733e456a2a942f859a1b59c4a7b2150", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Locky Ransomware", "colour": "#2274EB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700520927, "uuid": "89b53d00-993b-4477-bb7f-2df44e8b67de", "comment": "Malware payload", "value": "ce874f517d335a1e1ab0df99111df1d3adbc0d21", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Locky Ransomware", "colour": "#2274EB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700520927, "uuid": "5e0dd795-be31-457c-aa88-41b5ec80a1af", "comment": "Malware payload", "value": "a0a3c7720c26bc78cb7e021bbaa35fa1b37fbddc68585be57823d5ff544809e20f8ec46de30b1d68b469d1a1520ec315", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Locky Ransomware", "colour": "#2274EB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700520927, "uuid": "78e22df3-3592-4827-8d46-3597d2b87226", "value": "T12CD3AE1631D0C171C0A31534EDA5BBA15AFDF8B44DB2479BB3AC067E6EA1AC08E74787", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700520927, "uuid": "041ef429-efc9-40d3-bb00-1bc99e6481c7", "value": "66ebbcfb37c7095ce144ec66699570b9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700520927, "uuid": "e747a732-f5ef-409b-b10b-7d27353885d8", "value": "3072:VV2vxw88jLtbMmJ2RqRADLK1iJ1/NvdOgecZlw/C:VV2v503kRqRuL0iJ1FdLec9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700520927, "uuid": "be50f0f8-2b93-4cc7-b81b-0705a36f6de4", "value": 138752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700520927, "uuid": "6be52c57-3e47-4c06-99ba-158ff03590cf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700520927, "uuid": "6a8681b2-2347-4b34-bc40-dd13df077511", "value": "f2c9ae3735430b930a81148c0bb470fcb733e456a2a942f859a1b59c4a7b2150.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05773a34-8740-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700441953, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700441953, "uuid": "1a0b74d2-09d0-49da-adf9-7f3cce9ec5e6", "comment": "Malware payload", "value": "775e07212cf120aedadea8e788c658fd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700441953, "uuid": "ab64a576-38e9-48e6-abbd-47802777bc2d", "comment": "Malware payload", "value": "f302f2b147fc5fd6f6649198af738bf84b541b42483c9f236bd6e7953fa4b56f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700441953, "uuid": "5ea4caac-2b61-4900-bae7-646c1480075e", "comment": "Malware payload", "value": "36ffd74653532e9eca491d36d8410977ff046f92", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700441953, "uuid": "f8ffceba-e6b4-4501-ba4d-1bd8ecd5c602", "comment": "Malware payload", "value": "c7ad9c8ec43d2e7cb605d74c5bf53505586af241a09c2053cacd60eb097e43a29909fc76146088bc90f35f161f1e725e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700441953, "uuid": "0f27e913-d9a8-4245-b4db-4b4db9435a40", "value": "T1B9763300B5C9D5B4E3E01431AE186FF8F621EB185B350BA33779948D6E169C9C33BEA5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700441953, "uuid": "194a72d8-eaf8-47ec-84c4-a1dc35a2ec8e", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700441953, "uuid": "50f30806-7885-447a-88e7-81beeaadcd80", "value": "196608:91OA4HrunKHBrV1HbU3dux+8y6SBVPD0OVTyTyTy+SfcY:3OJKodXssvNSBVPDPfTy/fcY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700441953, "uuid": "0b3a7db2-0f13-47b3-948c-caee2bcfd646", "value": 7515252, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700441953, "uuid": "da74a7c4-c098-4c9c-a18b-dbd98d8f9a07", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700441953, "uuid": "68b2b737-3657-4dba-ada1-9f2146fb1cff", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8e0a699-87d4-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700505793, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700505793, "uuid": "8d5793e3-a274-4d6d-9c61-174e5bc7d7ef", "comment": "Malware payload", "value": "28f311b23deddc598c23fc09041e1f3c", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700505793, "uuid": "2d66b7e1-7fba-47df-b631-fca8fd8247a6", "comment": "Malware payload", "value": "f321cee3408a4221ea90f4a9e92b3d3b221f19698b6d58b8bfbf840446fd7877", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700505793, "uuid": "0001157c-0116-47a7-ac5d-285eaac4dc67", "comment": "Malware payload", "value": "0c1c6b3990e51b9b37d56fed8e19e4302496e3a0", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700505793, "uuid": "805ee15b-2984-41bd-b671-3f7bdaa3e75c", "comment": "Malware payload", "value": "71777d1dc4b60841e3ac13481286b9751a86e72891533aa269bd487a5d41f5d94fe081520abe1539f09ee2761402e1d6", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700505793, "uuid": "65e58c90-683b-4257-9497-7eec5693e1d6", "value": "T1BE56E020BAA1C236D8B315BD4DBEA39A557EBB702F2451DB72C40EDE0E315D5AE30217", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700505793, "uuid": "1865319d-d983-4e21-a850-645b466ea515", "value": "49152:ZbWzE8JYy3o+w+X7gJhHcnsZ9UwgV+Ujga2xKMYPgWsnAEppMQn:ZbwJYBf67gHlUBV6DJAEpxn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700505793, "uuid": "917de758-cedf-45b3-af18-93337b7c43ca", "value": 6291968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700505793, "uuid": "1b65ad72-32a0-40b2-91ab-d95fc9dbfb3b", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700505793, "uuid": "38e66e70-4bb4-4d93-8917-e4024bba84b3", "value": "entrate.vhd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ea9cb94-87af-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700489830, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700489830, "uuid": "25846c88-0ba2-46e6-9f5f-c916ea9d6dce", "comment": "Malware payload", "value": "d15896099f435bd7d059d9a7778f8f18", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700489830, "uuid": "65f12f70-82ba-41b6-a533-119d60823b5b", "comment": "Malware payload", "value": "f491be101e102657eb0b68a5d492953d668dbbc5bc39863a65907871b71c9a74", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700489830, "uuid": "6bb7b298-6bc2-4e7d-9f8e-aad03792286d", "comment": "Malware payload", "value": "39cde61b83108a6760d3c3a1c22c831123fb8d43", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700489830, "uuid": "ca51e62a-f1dd-4f19-94b5-cd37bdf159aa", "comment": "Malware payload", "value": "84eb82e342657903a440407d5a2789b6da71dedeb9358254c72f3f90ba768b68d06226f27e60c47a351232f1ada70a71", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700489830, "uuid": "9c55ccfd-b8c2-4cb3-a7d9-eb6d2e0d1890", "value": "T1B535333E76DB7E5070A67275D67309FE9692CA6709088852B4A347E8AE1F3F0CF02547", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700489830, "uuid": "8ba68daf-2ed8-44d9-ba2d-29fc6a9db9fd", "value": "24576:XjzWQBPkDZCzh3gUSta9kWX/fwiOqSzmN0vsnDc/:XjzWUkgdCta9kWPf1OqSzmNRnDa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700489830, "uuid": "5bc5d326-2d36-40d0-a106-0f9c36d6a55a", "value": 1090625, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700489830, "uuid": "a8a29570-76fc-4a53-961a-9c99c05408ab", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700489830, "uuid": "556d9ca8-023b-4edd-a6b5-f2fa2923705b", "value": "PO_GE128023.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7df1dc3-87a7-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700486571, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700486571, "uuid": "621a9d28-77c6-4708-8efb-2af908b27807", "comment": "Malware payload", "value": "42b886a3171cba59ecb6c42dab4c193b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700486571, "uuid": "60faaaf7-bbe4-4cde-8816-9d123eb38e19", "comment": "Malware payload", "value": "f4da3c677723f97930f87cc8c601a2ae1ddf17ffbc016b58668184599c4e93f1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700486571, "uuid": "7872d572-f631-4da8-bd51-ac091ea04331", "comment": "Malware payload", "value": "2cf27f6f6cd4be4369620a861afb70a9b4979558", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700486571, "uuid": "5f6c7ffa-1193-4e0b-99ca-07fce7e55b76", "comment": "Malware payload", "value": "855467b82e4ad1a9cd202acaedc683e8dc46239938f37a938885edbe94faaccf23a9f17523287c0396f559874a36954d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700486571, "uuid": "257cc56e-f565-4962-8717-fb75bf71051c", "value": "T1F5D4BF397FD98A26E59E07B5B025347C83F4C11AE25FE7BA8C81A5E42C43741D70E1AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700486571, "uuid": "7e81ed00-fda4-4555-a249-cad60ca9b795", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700486571, "uuid": "2cd3299f-5d20-4b2f-90a2-cae18263127a", "value": "12288:LTpoAhCJ+rOxSrqtInGZ4xh0MyRz7379BXLGBYtpSa3BAfw:xq6nGZ4xh2RBBXLG6GABAo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700486571, "uuid": "e1b05570-1fa7-40af-b304-62cb1038ff32", "value": 603136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700486571, "uuid": "3b6ac54e-a915-47d5-8d86-9c3d758a10da", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700486571, "uuid": "89fce631-e5e3-4da2-93be-dfcb7b7f604b", "value": "S\u0130PAR\u0130\u015e FORMU_20.11.2023.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6eac0172-87af-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1700489804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700489804, "uuid": "528ee2d3-21f6-435a-8116-da9a0371dd87", "comment": "Malware payload (AgentTesla)", "value": "761b671d5b64b55a08df55fc1f719801", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700489804, "uuid": "06e2a543-ecf6-4b2c-8da7-804728c191cc", "comment": "Malware payload (AgentTesla)", "value": "f59249e0421edc3799b01d06dfdfd1877edb5bdf70d777e9aafbcf5570f641c5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700489804, "uuid": "69ec58e9-792c-458e-b285-1dc9cbc2214f", "comment": "Malware payload (AgentTesla)", "value": "72beee839b56b8473efa2e98d751f56251f4c571", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700489804, "uuid": "3aedfd96-df71-4e5d-b86b-51584407e0ea", "comment": "Malware payload (AgentTesla)", "value": "3b58111af5f625599ece5f5fab4a685d867f362a32b1d6abeea791817ad276dd96a24665a041506e2b3b20b8fd8ac51e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700489804, "uuid": "b076d0ef-2f2b-4361-846d-6680121e8c4a", "value": "T18CE4C43C5B9ED26B9EB9C6A6CBC1C01BF340B5A7320CAEE5ACD30355831295675C523E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700489804, "uuid": "29de0c56-192d-439b-9f3a-fa6bf90e1c78", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700489804, "uuid": "2404b8a8-6d84-453b-bb81-7b2275f9dbae", "value": "12288:nelc5Fqrvh3ukGR8FFkbuqqKRY+ROuUFkCiUJ+nkweoWy3Hr4l/rQyw8GzNKJ4ea:8qs+RtUFPJc7eoWy3L4llXG+4e67M8v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700489804, "uuid": "82cb684f-c236-49a2-b091-337f56421533", "value": 684032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700489804, "uuid": "439350ea-c529-48d1-8c2a-12f41e24c35c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700489804, "uuid": "2b0c105a-d1c0-4376-947d-46863b6a2e0a", "value": "PO771000.EXE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5dc629ec-87b3-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700491493, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700491493, "uuid": "ff2b1a2c-de37-415f-9503-71877a045b25", "comment": "Malware payload", "value": "99ea3d58b8dff34ab3de1f0518c10c3a", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "config", "colour": "#747DBB", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700491493, "uuid": "b1a902fe-b92a-4b4a-bef2-11f400a7de2f", "comment": "Malware payload", "value": "f6984e999b87eda435d684b71e81e6750dc885fd9ba3f59e1e20fefe8a55cae4", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "config", "colour": "#747DBB", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700491493, "uuid": "16322bbc-cfaf-49d6-9d78-332c460cc26f", "comment": "Malware payload", "value": "48e31b8c117a94a51e30dcb1b818b9b73197eb4d", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "config", "colour": "#747DBB", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700491493, "uuid": "8ef684f9-de6f-4e73-9ca9-b31ce5c35518", "comment": "Malware payload", "value": "7e0ad583031eb49a7eaaf694769b76798af6e5d7d55b58ddc3c46dcb76a217f06a0538ad51c1b1e8c166c3ddf3c160e7", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "config", "colour": "#747DBB", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700491493, "uuid": "17704009-ce5f-4b28-8600-c2e1125f2c7d", "value": "T1801523556FC931D1E56C42A9B00D195819FA322FEE7A03093FCA88F17DBD5392406BAF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700491493, "uuid": "a28c4273-b2bf-4f71-a67b-1324aed1d16e", "value": "24576:sIr370ncPiKoANTo0Tv0hCIpdHI0fq9y+8:sIDoncPieZo0g0IvHnfYu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700491493, "uuid": "f2aa3284-80a1-4781-9034-e13ceecc0643", "value": 945041, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700491493, "uuid": "f539c126-2eb6-412c-9056-fd8826bd5738", "value": "image/png", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700491493, "uuid": "fa6712c7-96f9-4c20-b58d-48cf6ca1795d", "value": "jouk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44acbab8-8785-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1700471694, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700471694, "uuid": "8804d018-4e63-4a0f-9bf7-991aef8ce6a5", "comment": "Malware payload (AgentTesla)", "value": "32a9a711591e86248b4f7f7fd61bdb9a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700471694, "uuid": "1f0889d3-9ec5-4de7-b038-25655dbf477f", "comment": "Malware payload (AgentTesla)", "value": "f70e01f4a72c535a1be730861b039702d7d96dc20556ee212f1e20e0f34d25e1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700471694, "uuid": "85258cd3-33d2-493a-bb65-19c7c619e63b", "comment": "Malware payload (AgentTesla)", "value": "589bf9da975e2bf7dc9878e3ccff15fd1287ac03", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700471694, "uuid": "4f96819b-068c-4989-8982-e8ddc2b40ad3", "comment": "Malware payload (AgentTesla)", "value": "a24769e2905fd4cedefc59aa7b0c228816da242d77d5315df230fd4b424ccbbf92f01ee52cd7600e65979ed2a5f5b9b6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700471694, "uuid": "fda1e1e3-8729-41c2-88b0-a8e430d8eb66", "value": "T1C2E423D53E2042B7C999E9F7106531501BBAB9587CA2CE8D0CDE28EE4BD6FC51903E87", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700471694, "uuid": "ba5a2866-7a1c-4ca5-a3e5-3543b6f1cd28", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700471694, "uuid": "99fc16a0-fc56-4c9f-b392-fde7205239e4", "value": "12288:qa361h61EWGxz8xSkApyzeGdi2dxTmVU8hd1ZsdO3HFuX2GMp0qEKeMpH0gw9gI1:q/Y7GxzUSXy77dxTma8n1Z+O3GxMp/3i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700471694, "uuid": "cf35bd0e-6b9e-49ba-a450-fbe1280585bc", "value": 670208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700471694, "uuid": "d8b6d5ca-2cd4-4153-862d-30a237993a63", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700471694, "uuid": "f1e9664f-7cec-4e75-b114-18c8d4aeffad", "value": "RMW-2422018376.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "616ed0e2-87e6-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1700513404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700513404, "uuid": "12c349a5-aacb-4fc6-9b4f-e0307fcf96f7", "comment": "Malware payload (Mirai)", "value": "6184a0925993a38872337d4d663beb0d", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700513404, "uuid": "4c0db0a2-d6e1-4289-8445-aef49031b52e", "comment": "Malware payload (Mirai)", "value": "f75e3dae44c5a3651030d8b56f312ba95dce2506d68207706383c7bb299f0731", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700513404, "uuid": "7ed4c040-26c7-4bab-aeca-6f1c2231acf0", "comment": "Malware payload (Mirai)", "value": "68dd16bbe4474ed26824de3120cb15f1cb99c070", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700513404, "uuid": "c7520701-a6c0-427c-a007-d1110c4efc3d", "comment": "Malware payload (Mirai)", "value": "664330a5241db6dd9098aa43b34869bfa2fae7d02e2ef2db79663fb0f8e27402aa3d4671effb93fab59fb150e623e6fa", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700513404, "uuid": "62e4280e-113a-4996-bcd5-414fe8568161", "value": "T14D92E00EE5F86747D0E4E37B53964A4E8EE3EA0A07CFAFA52FA018C627B700805C9510", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700513404, "uuid": "449eaec8-0c72-4744-b8f3-709ed5ac58de", "value": "384:M8TNHyuDg/VuV/9d2tBpWL4vcWlv6G0Lk8MS7mbFq8VdpFdSttCJ1uIqYK0f:tNS5/+d2BBvRv6VH7S3NAtCTBK0f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700513404, "uuid": "44a46ece-db73-41bc-a7dd-fb40b2af960c", "value": 19804, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700513404, "uuid": "5e5935fe-3ee1-41b5-b7a9-bf1217f1f91f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700513404, "uuid": "a45c726f-bd3b-4bbc-8a75-dd706bb10219", "value": "cool.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee3aadc4-8742-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1700443202, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700443202, "uuid": "19618f54-4651-48b5-ac25-3faca4b8f367", "comment": "Malware payload (AgentTesla)", "value": "9443087b549d9a9b966fd8af2d96db12", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700443202, "uuid": "c3f013b2-f1e2-4f06-afaa-c2074907a652", "comment": "Malware payload (AgentTesla)", "value": "f87c14dd9506eaa1a586eab0cea8c5850dad70fab34a8041179bf6765daa98a0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700443202, "uuid": "fde2656d-cca6-4fb6-b78e-72a945bf7657", "comment": "Malware payload (AgentTesla)", "value": "e00ed0ee13ae4fbc693d2acfcc652a17be73f286", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700443202, "uuid": "bd96512c-9ca6-4c91-89c7-1b323ab06b3e", "comment": "Malware payload (AgentTesla)", "value": "8fc8eaca3ee8c6e0c926af75b0768b20c381a6e2c79200855b597392f7c67020fbe544fefb9b62fcd01e51850be15234", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700443202, "uuid": "d966dbd8-49db-4bb7-95c8-093c2dba7bb8", "value": "T1E5E423F43924C5B3C4E653F6B0667DC183BAB0DA28A2C4EC1DE935ED46F6B012127297", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700443202, "uuid": "eae9bab1-ff3e-4798-844a-2bc04b78252e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700443202, "uuid": "5c693e48-7507-4096-95d3-5bd0e41fd7f6", "value": "12288:LU361h61EWGcDv7AuJUfWP07NLMgreTXpifWbbCeHY6pf95nHEBreg61:LJY7GYv7AumWoogrAXYfWdHY6pjHoW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700443202, "uuid": "efc35dd3-1d9a-45fd-889d-656929aedcd3", "value": 658944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700443202, "uuid": "9cea5b96-f584-4a22-a1ef-9fdbe6e72742", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700443202, "uuid": "6346ff17-88a8-4e1b-a0ac-d3772f128406", "value": "SecuriteInfo.com.Win32.PWSX-gen.7990.22052", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99ab3056-8771-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700463247, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700463247, "uuid": "71084f1e-79a2-42f4-bfcb-a193b756e54b", "comment": "Malware payload", "value": "4cb162fca2f99ac12528b1c581a5ca5a", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700463247, "uuid": "8175bfa7-8ca3-4b90-8141-21d9661e02da", "comment": "Malware payload", "value": "faf1a06485ba7fc1cf951ba0c3e3bd7d27d04e7ea0b5cb7070942baaa93fe3a7", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700463247, "uuid": "3f2b292c-6767-43c0-b59d-754dbbbb7a38", "comment": "Malware payload", "value": "6a371befea677f7c2e9387ff6af0a1fcd60644e0", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700463247, "uuid": "8d29d2c9-9a28-444d-9871-f20a3fdce2cd", "comment": "Malware payload", "value": "83316fc7d8d7a0f0c3eed0c1c0e9e4417db958d396825cb9f5d334443aab2759515a7a6f9765aa83ce5e5a2f7f4dc617", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700463247, "uuid": "3d593b75-aafc-4e05-92bc-8fba25dd27e3", "value": "T1C5D4236524BDF4449BF17203DB01F44245866E6C93BD8BEF1BB4B22435332A86A9FC67", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700463247, "uuid": "922690a5-6165-4df4-9aeb-ae7841cb7ae1", "value": "12288:IoU3cN5QTC016lpHLVC7PVGZdgDkStlBWyd4cz2+OcZnFiesRq+:IoUsNiTalJI4ZGISwyd4cz1O8FilA+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700463247, "uuid": "5040e314-6253-4867-a214-621b88ac18eb", "value": 628636, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700463247, "uuid": "ae96cc3b-bde9-4e09-9e06-592111ab5dde", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700463247, "uuid": "2efac7f9-e9d8-47c7-aeda-1ddfa2ab5ee2", "value": "PI-DOH_210050934AJDT.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ffbd576-87af-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700489752, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700489752, "uuid": "c95c689e-4b02-47f0-bf92-6a0cf6a481a3", "comment": "Malware payload", "value": "362b25f951b251bc6e5ab3939fe71e1d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700489752, "uuid": "7e8b9fc6-2d03-4ba7-acdf-47946937049a", "comment": "Malware payload", "value": "fb9d64ed3d39238fa349c70e55f2da7ab7b04ee3b04361152f144dd142976263", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700489752, "uuid": "6af3f549-3c9d-4e49-8dd4-7b11f83979a4", "comment": "Malware payload", "value": "f3c20bd4288822eb7857ef7d244cbbe72530385d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700489752, "uuid": "f4b45f57-b0c7-4cae-84c2-657fb8a995d1", "comment": "Malware payload", "value": "face227bf1626464395d94d67bef2076cc9555987d391e46488c1b176bdfedd4d14edf31cf15ecc9c137e3e9c820cb0f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700489752, "uuid": "9ea97868-d92e-466d-9596-07eb6bbb2ae9", "value": "T1C9D53342760DBA8ECDEC43B4CF9B93F51052F3FA069251E15B3F81478B46F99981E462", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700489752, "uuid": "7dd94c1a-8fe3-48e5-b424-2ffa999fbda7", "value": "4328f7206db519cd4e82283211d98e83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700489752, "uuid": "784c8c2c-40c7-4379-a563-c154051ee593", "value": "49152:FWwvzKBJQ/7AZ56737bub4VshPmtzkPE1XIp4kmExSh0ueykizldxAyfJWQD+bTB:HvOBJy7/DVs2zkPppQQ9ykelJhWqsTZX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700489752, "uuid": "3cf047cd-d1d1-4ee9-ad97-24d74852d890", "value": 2859160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700489752, "uuid": "b0784212-58f0-4d80-847f-9b27dc0aa035", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700489752, "uuid": "a53ee56a-56b8-47bc-bef6-fff4dad0fdbe", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a492466-8780-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700469556, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700469556, "uuid": "c633590c-1ec3-4735-bbf7-c814fea190e1", "comment": "Malware payload", "value": "bf745642d5cb6587555021efd0ffb1dc", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700469556, "uuid": "6937f323-39ff-4474-b852-176418dffdda", "comment": "Malware payload", "value": "fbb5951c21099e368d2eff686cdae2f901c15e77077193e00a9e6ebf6c72c0a3", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700469556, "uuid": "49facffe-ed0b-46c4-9c56-e422283076ad", "comment": "Malware payload", "value": "9b99daa1e872645ef6dffe3d85b62cd48407e08e", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700469556, "uuid": "f6cc14c3-5dd3-42c3-9861-d6b3d4ae588c", "comment": "Malware payload", "value": "25f5e9f3e159e85105493d395d89fa63ed5fb9fb31af0cc1c5ecc6d001ff5fb47eac123e7d8823a9e1ff97c4a27c6c8c", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700469556, "uuid": "d3377892-0a23-418d-bb0d-02085dbfa5db", "value": "T1F0711AF5A74C8E93C82F48E6D9983DB507C2F173CEDB258411A6F6B10C133698C69C55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700469556, "uuid": "70f9f038-7ca6-4117-8700-4428897bce35", "value": "96:DVlKVXreoSArw8sORegFl9vKNpXnvotprJhrCB:DDKVXrfVsEP9iNqtpTI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700469556, "uuid": "10dabadf-8074-4f95-a0e2-032e773aac4a", "value": 3676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700469556, "uuid": "2de22c1a-b5a2-4491-9491-886139eaf6df", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700469556, "uuid": "c7f31c8a-408b-4cac-b395-311b7b969a5e", "value": "FedEx AWB# 985451609094.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abc6fd59-8782-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700470579, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700470579, "uuid": "90dd253b-88b7-4f13-a485-9f69ea0b637e", "comment": "Malware payload", "value": "df50f3c7a997f88e0952919b35f1cceb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700470579, "uuid": "4a682c67-ce06-4dbf-a1ab-0b47e38f9503", "comment": "Malware payload", "value": "fcdede6ddb7b5755021825a9a36dffd4ffe2a47bd96e7b5bd0b7695ad8a95e2f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700470579, "uuid": "553b5bcf-4f0e-4a0d-a24e-cb580b89632b", "comment": "Malware payload", "value": "b9952e1b209d955ce34e66838f33ed71324f1041", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700470579, "uuid": "9f6bfe7e-7421-4a56-b8e1-a7dbee88525c", "comment": "Malware payload", "value": "c63b0c3ef16e3a78e7a7f7af074268abcf515c3c5c5f8eeaf84d70ade383db6f44d6283f019cc88fe29aec7a145cfeb7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700470579, "uuid": "dc5484a2-1767-4200-9f8f-13ef0e25743b", "value": "T14015235862A0C6D3D9866330D238D0BA67D8A93B5C65CB9F1B107F8EBC72790CD1462F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700470579, "uuid": "07e57015-44cb-4a79-a741-7528d73f9f22", "value": "9dda1a1d1f8a1d13ae0297b47046b26e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700470579, "uuid": "62055ad3-06c7-4659-994f-a88c6a32a841", "value": "24576:bPdiCiCuCK4+f1ZfLej2BPbP8pSnsogsTR02:Rji6KPf/LejogisoBW2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700470579, "uuid": "ee6e2aac-33ee-4066-b8ea-20f74d225e2c", "value": 899672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700470579, "uuid": "34180442-9f67-4282-8b9e-b08ea2d83d9b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700470579, "uuid": "0ac7fc3e-25c5-42ee-b983-ccd65e88e610", "value": "SKMBT - 0800003385- 20-11-2023 - SALIPRO.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90203943-879b-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700481270, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700481270, "uuid": "db31f780-4a82-48ee-b415-13ab5cf5347c", "comment": "Malware payload", "value": "0bb397b027f6921504e95ae26fe4d5e5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700481270, "uuid": "159c3d66-86dd-4191-9a39-a113600e1ace", "comment": "Malware payload", "value": "fcf6025ac7e0758b08ab3dc48e99822567bbba367dcfd4c045ab86d987a5a97a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700481270, "uuid": "8e54546a-4c89-4aa1-8b2b-9751cf8f497b", "comment": "Malware payload", "value": "88e78347ac3eeb2892023a675ad1a6a935d38b36", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700481270, "uuid": "c911ed4d-d8d7-4833-b8e3-703dd6c7a89b", "comment": "Malware payload", "value": "622cf36349c881cf45afbaa948f2b02280c90cf3fd53f678f2453f1cb79b15484ed5e30a4f5621bceb6e558b870ef5de", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700481270, "uuid": "1162da9b-c26f-4d6e-ad8a-9ca2b3839395", "value": "T13D452342A7D98063D57AA3F519F946432A3AFCA35EB9D75F1388C8440C737E4D231B2A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700481270, "uuid": "09438106-0cd3-454c-8a51-aca6bebd3dd1", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700481270, "uuid": "267e29dc-feb7-48af-9aec-480fd4abf866", "value": "24576:Dyy44+Pqhyf4mU1T7HlV+f3yF3nIAmEV/w67fHyAruVrepJIBGY:WH4PhaU1T7FV+f3yF3IAm6/7fDruNeDX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700481270, "uuid": "237ec021-4524-4519-9c2c-99d2d9612cd1", "value": 1200128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700481270, "uuid": "6219306c-3d35-4ddc-8423-bb3bef8a1267", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700481270, "uuid": "9bfc514b-9849-4178-acf0-1f9c3f7d32a6", "value": "0bb397b027f6921504e95ae26fe4d5e5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86d318a5-8777-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1700465792, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700465792, "uuid": "dfa75920-4fd4-43f5-8630-2403545fd20e", "comment": "Malware payload (AgentTesla)", "value": "78ba688489c8d75b1c4975344f05796f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700465792, "uuid": "932000ed-4565-4d17-a92e-b81c0a4be332", "comment": "Malware payload (AgentTesla)", "value": "fcfa322e713fe0085f12ec3a1ba8ac0c4651b463d831586497fab4d0c21d3865", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700465792, "uuid": "44935a7c-fa1f-4a1b-b18b-8c1ec28cf039", "comment": "Malware payload (AgentTesla)", "value": "c4e7ab92a7e6436c21e7df5507fb28404c9e1068", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700465792, "uuid": "9df176ed-dcb8-48bf-8e7c-40f979c99537", "comment": "Malware payload (AgentTesla)", "value": "ea54f891e5aa1b64b0a53da7f09766efb1f7dd8cffb9238d78a57187fc6b7f2526f046386432669628c8bffe4a50e4b3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700465792, "uuid": "60c4e089-048a-4916-ad9a-922fd0c6cad4", "value": "T16AF4DFAC7251BDDFC86BC475CAA82C64EA217566931FD207A01701EDAA0DAE7CF111F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700465792, "uuid": "e412ff0b-de6d-462f-a7bb-c1fd3698248f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700465792, "uuid": "f93772d9-3581-4b00-9120-68c88fd29230", "value": "12288:+z8J0ZQAFnS2Ejjy1U7q76xUlV8kBqjHLfGh1aGrUwONvueg2HepOxbcVbpPk3aX:+z8JxqS2EiKU6xy8qq3f41aREewkbC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700465792, "uuid": "9145d61d-8538-4cd7-94ea-2a7947fd3505", "value": 757248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700465792, "uuid": "e3474c33-f748-4c61-a2fe-c1e4a9d4319e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700465792, "uuid": "5bdd06a5-d0d8-44e8-bb37-c60fb98906d3", "value": "Data Sheet.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92f62121-87f7-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700520788, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700520788, "uuid": "57af77c9-3eb3-4e65-a840-da4592e67c98", "comment": "Malware payload", "value": "c7cfaca6501361febe27a6b3e66a61bf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Povlsomware", "colour": "#7124A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700520788, "uuid": "413920e5-6e1c-4ee1-8a66-233d1c6203eb", "comment": "Malware payload", "value": "fd32cec288cec4f16dc5430cf86dc17e1d4cf941d635979fc17a59c8d6d83d44", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Povlsomware", "colour": "#7124A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700520788, "uuid": "bfbdce31-4640-4f33-9feb-895e003850b1", "comment": "Malware payload", "value": "55a3414b9668596e120139a059db91a306281dcc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Povlsomware", "colour": "#7124A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700520788, "uuid": "d0d8b42a-dd7b-4360-8d97-7416884529d8", "comment": "Malware payload", "value": "ac81f9816515c5737edc1b7242be06c974b51fa1d3a7e36da45ab0c263a7a0f20c38f27f35041a886d9812761bf9f774", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Povlsomware", "colour": "#7124A1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700520788, "uuid": "9047674f-97a7-41be-b545-105779683b2f", "value": "T11CC22A0132E84B70E2FD5BBA2DB266C207B5B95F5815CA1D7D8C518C1B73B648A22F93", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700520788, "uuid": "357395b5-7962-4cbf-a8df-7b77a2413330", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700520788, "uuid": "b478a644-17db-4b3b-b985-e70807291c2f", "value": "768:57NEFbb6uTIm2IfuxvMG0HRvMG0H0uc5tunpqKYhJ:57NEwSIjIyvcHRvcH0gnpqKmJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700520788, "uuid": "b5261213-97ce-45d8-a2a8-d691587d611d", "value": 27136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700520788, "uuid": "95d35ad3-bbef-40cf-9fc8-45de63f81f9e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700520788, "uuid": "aa393f96-7c10-4894-807c-5d9c7f7a18dd", "value": "fd32cec288cec4f16dc5430cf86dc17e1d4cf941d635979fc17a59c8d6d83d44.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e0efceb-87c1-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700497614, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700497614, "uuid": "2f01f18b-aa5b-4799-add0-7b40dc1d78c9", "comment": "Malware payload", "value": "49755c99b91238535fad76cbeb941b16", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700497614, "uuid": "d967d97c-3685-40f7-a94e-752446e98e0d", "comment": "Malware payload", "value": "fe18e9d143d5e3e6173ce7190129448239cfebc256ab245878788864de944796", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700497614, "uuid": "9d356309-8b81-44ec-93cc-ba2e140ce8dd", "comment": "Malware payload", "value": "13d181ca2fc18d8e204295561bb0757f05781282", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700497614, "uuid": "3236e2c3-5eb5-4b21-8294-2cd64f81e297", "comment": "Malware payload", "value": "9de37acd42d996c19446fa9e6283ec5648325646ea8b08db81bdf3c180e7851d58477693b991851a5f1ce7c1615c07ca", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700497614, "uuid": "64750cbb-33e3-4528-aab2-97eb3e05fb82", "value": "T1F726ADB53A4AD6FFC31B0C75E583D90795A433E14F119657EABD3E3C8B12C821A86788", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700497614, "uuid": "00a2e4d2-9474-4615-a80b-93877cfe5784", "value": "c7088447aaf3343c2f16f44c942b43d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700497614, "uuid": "1d48ace6-2e63-4f07-ab32-1ec5fa62e6aa", "value": "98304:LEGNXqoFaSFzAOwGZCnat/6YOk99pjRWx8YTDSmZ9t0Y5yrnzC8F+jVFYfglR:LrjhtSAvOtZYEedYFYfgz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700497614, "uuid": "81c36643-c4a2-4573-8237-b74f17f25f11", "value": 4826456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700497614, "uuid": "b7e5c91f-5841-4d41-bdd0-1e1237cc12df", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700497614, "uuid": "783a79ad-090c-423f-8c49-105f06605a69", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea837b11-879d-11ee-8907-42010a9c0042", "comment": "Malware payload (NetSupport)", "timestamp": 1700482280, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700482280, "uuid": "fc03d87d-701e-4a0b-a68d-76678b8fea90", "comment": "Malware payload (NetSupport)", "value": "e2c9952d79ac6110dbdc0a1269e6eaa2", "object_relation": "md5", "Tag": [ { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "SmartApeSG", "colour": "#C06213", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700482280, "uuid": "3801d122-778b-4371-96de-13db9cbacc41", "comment": "Malware payload (NetSupport)", "value": "fe8d5d825b1d368e1f5f8e27db20f347d35b257f48685e0ed103efba5bed99a2", "object_relation": "sha256", "Tag": [ { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "SmartApeSG", "colour": "#C06213", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700482280, "uuid": "6efcd80b-4598-4b6e-8938-10acb3461e45", "comment": "Malware payload (NetSupport)", "value": "c4b61d3c78145a272abb6c3f59e4cd1f3d36a006", "object_relation": "sha1", "Tag": [ { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "SmartApeSG", "colour": "#C06213", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700482280, "uuid": "507b4075-d4f1-46ff-96e0-5d27561d55ff", "comment": "Malware payload (NetSupport)", "value": "6b568a9c79aa4bf04f449a664163e4dd6b569cc62e276f5fc7a2835e206c556d39c562090cc00189a7f62558206f31e2", "object_relation": "sha3-384", "Tag": [ { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "SmartApeSG", "colour": "#C06213", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700482280, "uuid": "c49f935e-ec05-49ae-b7e1-ceeaa7b7a093", "value": "T102F533063293FBB6C0E1F67BE0ACA8155A6D747CE4F7B476597EA153E93A431982F000", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700482280, "uuid": "b4cd63bf-5227-4638-85cb-e53e0c6aeb80", "value": "98304:d1OFXamhRFY89YYc9jh23redpmQRiXuYESBZFR02jZWl7D:bOHxYoY59V0redpmQRiNfZs7D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700482280, "uuid": "6c8cc8cb-dedc-42a7-b2ad-a648d9f45d65", "value": 3441927, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700482280, "uuid": "a47ce6c1-d02b-4656-a28f-8de065742dc6", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700482280, "uuid": "d09879bf-3340-4225-9b0c-80b48e8bbf21", "value": "luxe.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "667cfd89-8795-11ee-8907-42010a9c0042", "comment": "Malware payload (LummaStealer)", "timestamp": 1700478623, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700478623, "uuid": "b3d19778-3e75-4155-bf9f-7bb2e525919a", "comment": "Malware payload (LummaStealer)", "value": "283e72fbf2c6d5af415b2ef437ce82f8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700478623, "uuid": "d4af37f0-5b81-4c25-be69-c858672763a7", "comment": "Malware payload (LummaStealer)", "value": "fed18f7acebaa30f644c8a7de8229ef2d05e9cd213fdcf37881ef29fc0238bbc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700478623, "uuid": "7bff8d1b-99be-4f3c-bebe-4bb3b259551a", "comment": "Malware payload (LummaStealer)", "value": "4f908a45e49cf7f3ad48b90cca5b9bb4aca26faa", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700478623, "uuid": "90e0df71-8d29-4ca0-8adf-cd014b02c47b", "comment": "Malware payload (LummaStealer)", "value": "3235096915acf1e3a9a305c474a274b8e5e21a00b726b3f364b1ad61989d5de6e76cfb00e03feaf6ef1a14828e361ee0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700478623, "uuid": "972d2f1a-3a5f-42d5-9c6d-4de034aed15c", "value": "T1BA45230576D542B1D4B51BB119FA47C3073BB8A78C79432656CEDC5A08B3BC8AAB132F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700478623, "uuid": "e3bb5e89-5294-4bb3-b932-8d85fa51a056", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700478623, "uuid": "f480bae7-7d92-49cd-b4ac-bd87c2a5eab3", "value": "24576:oyPuSciMrLXzHsYHTbvlk9W4/qAaVvphDb/DqnTfLSo+7xQfLkA:v2iMrzzHpbaun/DkTDSmfQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700478623, "uuid": "dc8d2da6-5843-4882-9593-3ee37fda5c60", "value": 1198592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700478623, "uuid": "325e61ea-221a-4c6a-9e56-82ab244b6711", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700478623, "uuid": "fa4952c5-c555-473a-9b38-c8585be15ac7", "value": "283e72fbf2c6d5af415b2ef437ce82f8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9cc663e-8782-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700470629, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700470629, "uuid": "403e73bd-3470-48a1-83e2-0acf71cb9cf7", "comment": "Malware payload", "value": "13c576c5b5c023db976607b29cb106cf", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700470629, "uuid": "8f6762f7-01c4-4718-95ea-398bb4b2c0ad", "comment": "Malware payload", "value": "ff9bf989ddd0581391ab9bd9a669a7f76ee69335c96026486d5aec18938e98e6", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700470629, "uuid": "9da4db2b-e3f2-43a0-83ee-ef580c706976", "comment": "Malware payload", "value": "60d94eb00812dee08abf26b3ebebd7e8a57e942c", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700470629, "uuid": "feb8eeae-fd9a-4573-954c-e591011793fa", "comment": "Malware payload", "value": "d393bd653fd8ee0430634993e56cd2ffee826f12ba0f03569e2e7ccd428616ef151a7a5128b9de83e77513a1c30af389", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700470629, "uuid": "46195743-febb-409c-94ca-42013b45a48e", "value": "T105F4335568FFAE698ACFE31695C7CF0AC63C15E6B3345E63BC108DA94005BAF87424C8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700470629, "uuid": "97b2e23c-45be-4bd6-9561-3edc1617ebb1", "value": "12288:WdKxctcupNZwdBdIN7LKDTD4hLV4dQXitRMxPm8gztM1pyRNh4NT1bifTjbxZZo:WLxpYdIN7NXXC6zgzu1GuBbifT5fo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700470629, "uuid": "39e57ceb-7136-42e7-b920-eb0c441cdcc2", "value": 729283, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700470629, "uuid": "ef03e1ec-6884-4cc9-a017-72c89497fc27", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700470629, "uuid": "02d622a8-7d1a-4edd-b16c-a76ab1b6cf3c", "value": "QUOTATION SYSTEM.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8447cdf-87a4-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700485310, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700485310, "uuid": "9ab748b8-636b-4e86-8dfc-50fcc0c84b04", "comment": "Malware payload", "value": "77be796a24d4265164ab8e391b890429", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700485310, "uuid": "9a303125-318e-413a-8884-47afbc118cdc", "comment": "Malware payload", "value": "ffa38121ce884376872a6ee925945e2c7ae39ecedd04ba3c52938d6241956456", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700485310, "uuid": "4b45d8af-07c2-48f3-89a5-2202a1c6e05d", "comment": "Malware payload", "value": "99cf95904d3dd39f5a0d61499eaeaa73bb93ed65", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700485310, "uuid": "00aeb23a-8dde-4dee-856f-66b1adec9c9d", "comment": "Malware payload", "value": "6e3669d1a7712445a3ed2d15b2592ec04339eccea2cb41a03a1b1ebda5f3cdd349a597462c7aa53561e3bfd664093922", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700485310, "uuid": "24f6400d-92aa-4530-ae97-9d243b9ccf12", "value": "T10D85333E52014513E2E4F83521832314454B7DBAFA290BDA6BF2E59B1619BF0F278DDE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700485310, "uuid": "7b688de0-8ffb-419f-8f4a-ff6f8834cc6b", "value": "49152:NB6C/Z5l1ERoHYtU3hSHjnJlILHGWsy3Sr0:b/dqRo4K3AHrJlIbpZSr0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700485310, "uuid": "6d9b2fb6-7d97-490d-ae9c-e47b6c8f5eb9", "value": 1723224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700485310, "uuid": "e5cc19e5-ba31-444d-9170-0bfb1af41b7c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700485310, "uuid": "89bbbf4d-a3d6-4462-9350-207dab279fae", "value": "rete.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c617048-876d-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700461480, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700461480, "uuid": "de62a639-13fe-4b81-8fc7-54acf5dd118f", "comment": "Malware payload", "value": "fbcb9fc8e092eab43de04d9748719ea6", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700461480, "uuid": "73b935a2-0f7a-465a-b6c1-7865e74dcd2e", "comment": "Malware payload", "value": "ffa4c275493b09b2d8cc6cc49eda4e13078365415b6890e0762b002f823029ec", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700461480, "uuid": "6ed53efd-4cd6-43a6-b8ed-dbe46f3b9265", "comment": "Malware payload", "value": "19303db3515b5fdc59fd85b42dafe1174bddd282", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700461480, "uuid": "4bf959d2-e188-4877-bed8-1a24c877c6f4", "comment": "Malware payload", "value": "d2221af40ff878cbadcff0f591986ecf5a1ed65c2b73af76b669de7d149a86646aee519fd8b29dab9d44fe18bc2a31b2", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700461480, "uuid": "4f9de240-3465-4201-9a21-a96db699b054", "value": "T13B073AC7F85141E4C0A9D33486668252BA703C994B2027D73B5CFEB82F76BD8AE79354", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700461480, "uuid": "66af7b32-4191-4986-ba6a-cd6197dbb0be", "value": "b2e121c8fb86c781c89c83ffff7fe337", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700461480, "uuid": "673a4a8f-abda-4590-9536-c1b52d4891de", "value": "98304:wAVdd2L4ubewkZwaKZcz/gDbt1He+GP2wrD7Qvd30CwEw8ctQIlB7dxmlT32:wUWZbNZ1LN6UvrwTtQwdIB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700461480, "uuid": "2477ac55-23ae-4728-916f-b4440dda341b", "value": 17271296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700461480, "uuid": "d6b514e4-172d-4f23-8186-f8006d56f6a0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700461480, "uuid": "b7f0d5be-b7e1-442a-80de-70ade72e0544", "value": "fbcb9fc8e092eab43de04d9748719ea6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }